Method and system for aggregating algorithms for detecting linked interactive network connections

1. A method, comprising:

executing in parallel a plurality of stepping stone detection algorithms by utilizing at least one computing device, each of the plurality of stepping stone detection algorithms generating a result;

scoring the results for each of the plurality of stepping stone detection algorithms;

generating a consensus attack path based upon the scored results;

normalizing the results; and

aggregating the normalized results.

2. The method of claim 1 , wherein aggregating the normalized results further comprises averaging the normalized results.

3. The method of claim 1 , further comprising:

adjusting the results based upon semantic differences of each algorithm.

4. The method of claim 1 , wherein the plurality of stepping stone detection algorithms include content-based algorithms and timing-based algorithms.

5. The method of claim 1 , wherein the scoring results for each of the plurality of stepping stone detection algorithms further comprises:

receiving a result of one of the plurality of stepping stone detection algorithms;

determining the type of result received;

normalizing the result based upon the type of result received;

identifying any semantic differences relating to the result received;

adjusting the result received based upon the semantic differences;

determining if each result from the plurality of stepping stone detection algorithms has been received;

performing each of the receiving, determining, normalizing, identifying and adjusting steps if it is determined that each result from the plurality of stepping stone detection algorithms has not been received; and

aggregating the results if it has been determined that each result from the plurality of stepping stone detection algorithms has been received.

6. A system, comprising:

a plurality of hosts connected via links on a network;

at least one tap on the network to monitor traffic between at least two of the plurality of hosts, wherein the tap is configured to execute a plurality of stepping stone detection algorithms, each of the plurality of stepping stone detection algorithms generating a result;

a computing system operatively coupled to the tap and configured to score the results for each of the plurality of stepping stone detection algorithms, the computing system further configured to generate a consensus attack path based upon the scored results;

normalize the results; and

aggregate the normalized results.

7. The system of claim 6 , wherein the computing system is further configured to average the normalized results.

8. The system of claim 6 , wherein the computing system is further configured to adjust the results based upon semantic differences of each algorithm.

9. The system of claim 6 , wherein the plurality of stepping stone detection algorithms include content-based algorithms and timing-based algorithms.

10. The system of claim 6 , wherein the computing system is further configured to:

receive a result of one of the plurality of stepping stone detection algorithms;

determine the type of result received;

normalize the result based upon the type of result received;

identify any semantic differences relating to the result received;

adjust the result received based upon the semantic differences;

determine if each result from the plurality of stepping stone detection algorithms has been received;

perform each of the receiving, determining, normalizing, identifying and adjusting steps if it is determined that each result from the plurality of stepping stone detection algorithms has not been received; and

aggregate the results if it has been determined that each result from the plurality of stepping stone detection algorithms has been received.

11. A non-transitory tangible computer-readable medium incorporating computer-executable instructions, comprising:

one or more instructions for executing a plurality of stepping stone detection algorithms, each of the plurality of stepping stone detection algorithms generating a result;

one or more instructions for scoring the results for each of the plurality of stepping stone detection algorithms, wherein the one or more instructions for scoring results further comprises one or more instructions for normalizing the results and one or more instructions for aggregating the normalized results; and

one or more instructions for generating a consensus attack path based upon the scored results.

12. The non-transitory tangible computer-readable medium of claim 11 , wherein the one or more instructions for aggregating the normalized results further comprise one or more instructions for averaging the normalized results.

13. The non-transitory tangible computer-readable medium of claim 11 , further comprising:

one or more instructions for adjusting the results based upon semantic differences of each algorithm.

14. The non-transitory tangible computer-readable medium of claim 11 , wherein the plurality of stepping stone detection algorithms include content-based algorithms and timing-based algorithms.

15. The non-transitory tangible computer-readable medium of claim 11 , wherein the one or more instructions for scoring results, further comprises:

one or more instructions for receiving a result of one of the plurality of stepping stone detection algorithms; one or more instructions for determining the type of result received;

one or more instructions for normalizing the result based upon the type of result received;

one or more instructions for identifying any semantic differences relating to the result received;

one or more instructions for adjusting the result received based upon the semantic differences;

one or more instructions for determining if each result from the plurality of stepping stone detection algorithms has been received;

one or more instructions for performing each of the receiving, determining, normalizing, identifying and adjusting steps if it is determined that each result from the plurality of stepping stone detection algorithms has not been received;

and one or more instructions for aggregating the results if it has been determined that each result from the plurality of stepping stone detection algorithms has been received.