I study computer security and I read articles about the potential usage of sequential pattern mining in IDPS products:

I am curious if any of you have seen these sequential patterns and set any rule for them in practice e.g. in a SIEM or IDPS system. I have the impression that most products support only association rules and don't analyse the sequence of the events, packets, etc. I think some attacks can be detected only by checking the sequence, because a single event or packet does not contain enough info about the ongoing attack. I guess most people do this manually instead of using sequential pattern mining and matching algorithms or they use a fully automated system and don't even know about this kind of filtering. Am I right or is this used in practice?

  • This is a duplicate of very similar question of the same author: Security use cases where the order matters
    – mentallurg
    Commented Apr 24, 2021 at 21:34
  • @mentallurg Sorry, I wrote that one, I just deleted it. It is a similar question, but not exactly the same. There I looked for examples of sequences without much success, here I look for tools that I can configure for detecting sequences or the answer that there is no such tool in practice.
    – inf3rno
    Commented Apr 24, 2021 at 23:21
  • You don't show any efforts done. This is not a site where somebody googles for you. If you google, many tools are listed the first 10 results. Show what tools have you considered and why they don't fit you. Until you show that I suggest to close this question.
    – mentallurg
    Commented Apr 25, 2021 at 14:20
  • @mentallurg What do you mean I have not googled? I spent 2-3 months on the topic including googling. I got articles about theoretical solutions, not concrete tools. All I can do is checking the manual of each IDS, EDR, SIEM, etc. system and look for sequential rules, which takes a lot of time. This is what I do now, but it would be simpler if people who has experience with these tools would answer.
    – inf3rno
    Commented Apr 25, 2021 at 17:27

1 Answer 1


This depends on a lot of factors, like: vendor of the IDS, the settings, which signature is being triggered and what kind of attack is being initiated. In short yes, UTMs of the common vendors (CP, Fortinet, PANW) all store a copy of the traffic in memory for analysis.

For instance, you could configure in an IDS that a RDP Brute-force attack is only flagged as such when the signature has been identified X amount of times in the last N seconds. This is to prevent any false positives, especially when you have an IPS blade on top of it conducting preventive actions.

With regards to SIEM this completely flexible, you can build use-cases in numerous ways and correlate alerts from various sources. For instance in the case mentioned above, you could correlate this with the log sources from the source-device and a Directory Service.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .