Text this: Hybrid of structural-causal and statistical model for intrusion alert correlation