Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Intrusion Detection

Background:

• Hidden Markov models (HMMs) are common for multi-step attack detection.
• The Baum-Welch algorithm, used for HMM training, is sensitive to initial parameters.
• Current initialization methods often lead to local optima, reducing detection effectiveness.

Purpose of the Study:

• To propose a pre-training method for HMM-based multi-step attack detection models.
• To enhance model training by addressing the local optimum problem.
• To improve the overall detection accuracy of multi-step attack detection systems.

Main Methods:

• Clustering alerts based on semantic information to identify attack phases.
• Pre-classifying alerts into their respective attack phases.
• Converting alert vector distances to attack stages into generation probabilities to initialize Baum-Welch parameters.

Main Results:

• The proposed pre-training method significantly improved detection accuracy.
• Outperformed existing methods including Baum-Welch, K-means, and transfer learning differential evolution.
• Validated effectiveness across DARPA 2000, DEFCON21 CTF, and ISCXIDS 2012 datasets.

Conclusions:

• The novel pre-training approach effectively initializes HMM parameters for multi-step attack detection.
• Semantic similarity-based pre-training offers a superior alternative to random or average initialization.
• This method enhances the accuracy and reliability of detecting complex cyberattacks.