DeepChronos: Temporal Neuro-Symbolic Reasoning for Multi-Step Attack Detection
[Kryptografia i bezpieczeństwo] Autorzy: Sofia Burkow, Andrea Agiollo, Enkeleda Bardhi i 3 więcej
Modern cyber threats commonly unfold as multi-step attacks comprising temporally and causally related phases. Current defenses commonly follow a detect first and correlate later paradigm. Intrusion detection systems classify events independently, while downstream systems reconstruct attack progression from the resulting alerts or audit records. In this context, learning-based detectors learn attack-step dependencies implicitly as statistical regularities in the data and cannot guarantee that their predictions follow the real attack progression. Conversely, correlation systems represent attack relationships explicitly, but apply this knowledge only after the underlying attack observations have been detected. We present DEEPCHRONOS, a neuro-symbolic network intrusion detection system that shifts the paradigm from detect first and correlate later to detection through logical progression. D…
- Kategoria arxiv
- cs.CR
- Kategoria
- Kryptografia i bezpieczeństwo