Detection of Multi-Stage Attacks Based on Multi-Layer Long and Short-Term Memory Network
Mengfan Xu, Xinghua Li, Jianfeng Ma, Cheng Zhong, Weidong Yang · 2019
Multi-stage attack is a new trend of cyber attack. It is difficult for existing schemes to identify multiple stages in an attack period and associate independent stages. To address these issues, we design a long and short-term memory network (LSTM) based on multi-feature layer. First, we introduce stage features layer, the historical data is stored and calculated to identify the different stages of variable durations in multi-stage attacks. Then, the time-series features layer is used to associate the independent attack stages to analyze whether the current data falls in an attack period. Extensive experiments indicate that our proposed scheme has a lower false positive rate than existing schemes by at least 65.83%, and the false negative rate is reduced by at least 65.26%.