Due to the current limitations of intrusion detection and forensic analysis tools, reconstructing attack scenarios from evidence left behind by the attackers of an enterprise system is challenging.
reconstructing attack scenarios by using the information from IDS alerts and system logs that have a large number of false positives is a big challenge.