Unsupervised multi-stage attack detection framework without details on single-stage attacks

Jinmyeong Shin, Seok Hwan Choi, Peng Liu, Yoon Ho Choi

Research output: Contribution to journalArticlepeer-review

10 Scopus citations


Majority of network attacks currently consist of sophisticated multi-stage attacks, which break down network attacks into several single-stage attacks. The early multi-stage attack detection methods focused on describing the detection rule based on the occurrence sequence of each single-stage attacks. That is, such works assumed that after details on single-stage attack behavior are obtained from attack knowledge, attack semantics or attack statistical analysis, the detection rules can be generated from their possible occurrence sequence. However, their practical usage is limited due to the high false negative ratio while detecting multi-stage attack that consists of diverse combinations of single-stage attacks during the long time period. In this paper, we propose a new multi-stage attack detection framework, which consists of multi-stage attack detection rule generation phase and multi-stage attack detection phase. After comparing the incoming traffics with the generated multi-stage attack detection rules, various multi-stage attack patterns are detected without pre-observed details on the single-stage attack behavior. From DARPA LLS DDoS dataset, we show that all the possible multi-stage attack patterns are correctly detected. Also, from datasets in CTU-13 including the large volume of multi-stage attack patterns, we observe F1-measure of 0.938 at maximum.

Original languageEnglish (US)
Pages (from-to)811-825
Number of pages15
JournalFuture Generation Computer Systems
StatePublished - Nov 2019

All Science Journal Classification (ASJC) codes

  • Software
  • Hardware and Architecture
  • Computer Networks and Communications


Dive into the research topics of 'Unsupervised multi-stage attack detection framework without details on single-stage attacks'. Together they form a unique fingerprint.

Cite this