G-CAS: Greedy Algorithm-Based Security Event Correlation System for Critical Infrastructure Network

Algorithm 2

The greedy tree algorithm.

	Require: the data of security events.
Ensure: the security alerts with specific conditions.
(1)	if Received a security event then
(2)	Greedy-Tree Init the rules.
(3)	DataSource classify.
(4)	Key-value Event-Parse.
(5)	LogicMatchers Generate Logic Matcher.
(6)	fordo
(7)	Meta-Match with tree structure.
(8)	Optimized in the greedy tree.
(9)	end for
(10)	fordo
(11)	Logical-Match based on the greedy algorithm.
(12)	Optimized in the greedy tree.
(13)	end for
(14)	Frequency-Statistic.
(15)	Threshold-Compare.
(16)	Alert-Formed.
(17)	end if
(18)	return Alerts.