Fig. 7From: OMMA: open architecture for Operator-guided Monitoring of Multi-step AttacksExample about the progress of a morwi through an event tree with parameters in Table 2. a e i arrives, morwi chooses tree δ j with e i ⊙κ0=1, bmorwi has to choose between found events in level 2, c Pheromone-based weighted random selection, d\(\left (e^{*}_{0},e^{*}_{1},e^{*}_{3}\right)\) and (e i ,e j ,e l ) as possible attack if \(\tau _{1,3} > \tau ^{atk}_{min}\)Back to article page