Anomaly based multi-stage attack detection method.

Area of Science:

• Cybersecurity
• Network Security
• Intrusion Detection Systems

Background:

• Multi-stage attacks pose a critical threat to cyberspace.
• Accurate detection of these complex attacks remains a significant challenge.
• Existing methods may struggle with the evolving nature of sophisticated threats.

Purpose of the Study:

• To propose an effective anomaly-based method for detecting multi-stage cyberattacks.
• To develop a robust system for identifying subtle attack behaviors within normal network traffic.
• To enhance the accuracy and precision of multi-stage attack detection.

Main Methods:

• Vectorizing intrusion detection system (IDS) alert messages using Doc2Vec to capture inter-message correlations.
• Modeling normal system states with Hidden Markov Models (HMM) to construct a Multi-Stage Profile (MSP).
• Dynamically acquiring HMM parameters via clustering and determining attack detection thresholds using generation probability (GP).

Main Results:

• The proposed method achieved over 99% accuracy and 100% precision in multi-stage attack detection across three public datasets.
• Experimental results demonstrate superior performance compared to three advanced multi-stage attack detection methods.
• The method effectively adapts to various attack scenarios, confirming its practical utility.

Conclusions:

• The developed anomaly-based method provides a highly accurate and precise solution for multi-stage attack detection.
• The Multi-Stage Profile (MSP) approach effectively models normal system behavior to identify deviations indicative of attacks.
• This research contributes a valuable tool for enhancing cybersecurity defenses against sophisticated cyber threats.