Multi-Stage Attack Traffic Detection Using Self-Supervised Learning

Multi-stage attacks (MSA) pose significant challenges to contemporary defence mechanisms, as their constituent actions often resemble legitimate network activities. Although accurate identification of attack stages is crucial for early detection of MSA, existing research focuses on supervised machine learning methods that require extensive labelled datasets to achieve effective performance, a requirement that imposes substantial data collection costs. Addressing this challenge, this paper introduces a self-supervised learning framework for MSA detection, leveraging unsupervised contrastive learning and random feature corruption techniques to learn robust representations of network flow data. This enables the extraction of discriminative feature representations without relying on annotated attack labels, reducing the dependency on labour-intensive data labelling processes. Using the DAPT20 dataset, we achieved 86.81 % in AUROC and 87.71 % in average precision, surpassing conventional unsupervised baselines by about 20 % and demonstrating its effectiveness in capturing and identifying attacks.