CrossAlert: Enhancing Multi-Stage Attack Detection through Semantic Embedding of Alerts Across Targeted Domains

With the continuous evolution of attack methods, cyber attacks have become more distributed and complex, employing techniques such as multi-stage network attacks (MSA). Monitoring tools generate numerous alerts during these attacks, but the high dimensionality and diverse features of alert data often result in poor detection performance. Manual analysis of MSAs is time-consuming, leading to limited labeled data. Additionally, changes in attack types and new domains cause Intrusion Detection Systems (IDSs) to perform poorly, presenting a significant challenge known as domain shift. In this paper, we address these issues by proposing a multi-stage network attack detection algorithm that enhances MSA detection through the analysis of high-dimensional alerts and the integration of various alert aspects. Our algorithm incorporates multiple facets including semantic similarity, anomaly scores, and feature extraction to identify relevant entities, detect intricate relationships, and uncover hidden patterns, enhancing the detection of multi-stage network attacks. The model was tested successfully using the DARPA 2000 and ISCX 2012 datasets, with completeness and soundness measured to evaluate its effectiveness.