  We present a novel approach to identify ransomware campaigns derived from
attack timelines representations within victim networks. Malicious activity
profiles developed from multiple alert sources support the construction of
alert graphs. This approach enables an effective and scalable representation of
the attack timelines where individual nodes represent malicious activity
detections with connections describing the potential attack paths. This work
demonstrates adaptability to different attack patterns through implementing a
novel method for parsing and classifying alert graphs while maintaining
efficacy despite potentially low-dimension node features.
