Research on Penetration Attack Detection Based on CNN-BiGRU-Attention

With the rapid development of network technology, the issue of cybersecurity has become increasingly severe. Network penetration attacks, as an advanced form of cyberattacks, pose significant harm to network systems. Current research focuses relatively little on the detection of malicious traffic from penetration attacks. This paper thoroughly studies and analyzes penetration attack behaviors, classifying the malicious traffic based on the ATT&CK framework and reconstructing a dataset that covers all stages and various attack techniques of penetration attacks.In response to this malicious traffic, this paper proposes a penetration attack detection method based on the combination of CNN-BiGRU with an attention mechanism. First, a Convolutional Neural Network (CNN) is used to extract spatial features from the penetration malicious traffic data, capturing local information in the data.Then, a Bidirectional Gated Recurrent Unit (BiGRU) is used to model the extracted feature sequences, capturing temporal information and long-term dependencies within the data, enabling precise identification of complex penetration attack behaviors. Experimental results show that this method achieves an accuracy of $96.28 \%$ in the multi-class detection of penetration attack behaviors, demonstrating its effectiveness in handling different stages and strategies of attacks.