Detecting and responding to cyber attacks is increasingly difficult as high-volume, complex network traffic allows threats to remain concealed. While Intrusion Detection Systems (IDSs) identify anomalous behavior, Attack Graphs (AGs) serve as the primary threat model for analyzing attacker strategies and informing any response. Despite the conceptual connection being recognized in early research, the field of AG and IDS integration lacks a common structure. This paper presents the first systematic analysis of AG-IDS integration, reviewing a 73 comprehensive works in literature. We introduce a novel taxonomy revealing that current research is dominated by specialized, single-purpose integrations, such as using AGs to filter IDS false positives or using IDS alerts to prune AGs. Our analysis highlights a critical gap: the absence of a unifying framework that treats IDSs and AGs as a cohesive, integrated system. To address this gap, we propose a formal AG-IDS lifecycle. This framework establishes a continuous feedback loop where IDSs refine the accuracy of AG models, and those updated models, in turn, enhance IDS detection capabilities. We provide a proof-of-concept implementation demonstrating the practical advantages of this lifecycle for threat detection and incident response. Finally, we conclude by elaborating on significant opportunities for future development within the AG-IDS domain.

翻译：随着高流量、复杂网络流量使得威胁得以隐藏，检测和响应网络攻击变得越来越困难。入侵检测系统（IDS）用于识别异常行为，而攻击图（AG）则作为分析攻击者策略并指导响应措施的主要威胁模型。尽管早期研究已认识到两者在概念上的关联，但AG与IDS集成领域仍缺乏统一的结构。本文首次对AG-IDS集成进行了系统性分析，综述了文献中的73项综合研究。我们提出了一种新颖的分类法，揭示当前研究主要由专用、单一目的的集成所主导，例如利用AG过滤IDS误报，或利用IDS警报对AG进行剪枝。我们的分析指出了一个关键缺口：缺乏将IDS与AG视为统一集成系统的整体框架。为填补这一缺口，我们提出了一个形式化的AG-IDS生命周期框架。该框架建立了一个持续反馈循环，其中IDS提升AG模型的准确性，而更新后的模型反过来增强IDS的检测能力。我们提供了一个概念验证实现，展示了该生命周期在威胁检测和事件响应方面的实际优势。最后，我们详细阐述了AG-IDS领域未来发展的重大机遇。