\subsection*{SAGE}\label{sage}
The tool presented in this section differs from previous ones as it is not an application that monitors or allows interactive visualization of inputted data, instead it autonomously calculates attack graphs from intrusion alerts. SAGE \cite{sage_paper} (which stands for IntruSion alert-driven Attack Graph Extractor) enables the generation of these attack graphs without the manual support of domain experts, making the use of these strategies faster and more accessible, addressing their previously perceived limitations of being costly and ineffective in real-world scenarios.

Attack graphs are visual representations of potential attack paths within a computer network. They depict the interconnected relationships between vulnerabilities, hosts, and exploits, illustrating how an attacker can traverse through the network. By mapping out these paths, security analysts can gain valuable insight into possible attack vectors and prioritize mitigation strategies to strengthen network defenses. Attack graphs aid in identifying and understanding potential threats, facilitating proactive measures to enhance network security.

\begin{figure}[h]
    \centering
    \includegraphics[scale=.25]{Figures/chapter4/Sage/bbb.png}
    \caption{}
    \label{fig:sage_b}
\end{figure}
\begin{figure}[h]
    \centering
    \includegraphics[scale=.25]{Figures/chapter4/Sage/cccc.png}
    \caption{}
    \label{fig:sage_c}
\end{figure}
\FloatBarrier
The tool processes raw Suricata \cite{suricata_site} intrusion alerts and converts them into consolidated sequences. These sequences are utilized to generate a machine learning model that summarizes the attack paths present in the data. Attack graphs are then derived from this model, customized to specific objectives and victims, proposing some concise and comprehensible data, effectively condensing extensive alert data to showcase the progression of an attack.


Using the tool's repository \cite{sage_github}, it is possible to download the code available in both the development version and the Docker version, allowing for quick configuration and subsequent utilization. To test its functionality, the Docker version was used, which can be found in the branch named ``docker" within the repository, and Suricata alerts from a college cyber defense competition \cite{suricata_alerts_dataset} were employed for this purpose. After following the brief instructions for execution, from a simple file containing 161 alerts, 51 attack graphs were generated, out of which 2 are reported in the images (figure \ref{fig:sage_b}, \ref{fig:sage_c}). This alert-driven Attack Graphs show paths towards an objective. Vertex labels (in red) are attack stage, targeted service and state identifier. Actions are identified by their shape, low-severity actions are ovals, medium severity are boxes and high-severity are hexagons. The first action in a path is yellow, while the objective-variants are red and actions that occur too infrequently in the analysis are dotted. Furthermore, the temporal information contained in the alerts is also displayed above their respective boxes. In addition to calculating the attack graphs, the tool also provides a final statistic regarding the frequency of various alerts present in the analyzed file. An example of the analysis test is shown in the figure (figure \ref{fig:sage_stats}).

\begin{figure}[h]
    \centering
    \includegraphics[scale=.7]{Figures/chapter4/Sage/sage_stats.png}
    \caption{Statistics on alert data}
    \label{fig:sage_stats}
\end{figure}
\FloatBarrier
SAGE has several strengths. Its main purpose is to reduce, or rather correlate, the various pieces of information contained in the alerts and provide the analysts with the right information through proper visualization. In addition to this, it can also be used for other operations, such as visually comparing different strategies adopted to attack the same victim, which is a highly useful analysis for an analyst. Another utility mentioned by the developers is the ability to utilize the tool and its results to improve or add IDS rules. Moreover, the option to use the tool without the need for specific setups or systems, thanks to the Docker container, allows for quick and simplified usage. The main limitation, however, is due to the only type of file that can be analyzed, which is Suricata alerts, although Suricata is one of the network analysis and threat detection software widely used by private and public organizations, it does not guarantee the tool's usability in certain analysis contexts.

