Bidirectional RNN-Based Few-Shot Training for Detecting Multi-stage Attack

Abstract

Feint attack, as a combination of virtual attacks and real attacks of a new type of APT attack, has become the focus of attention. Under the cover of virtual attacks, real attacks can achieve the real purpose and cause losses inadvertently. However, to our knowledge, all previous works use common methods such as Causal-Correlation or Cased-based to detect outdated multi-stage attacks. Few attentions have been paid to detect the feint attack, because of the diversification of the concept of feint attack and the lack of professional datasets. Aiming at the existing challenge, this paper explores a new method to construct such dataset. A fuzzy clustering method based on attribute similarity is used to mine multi-stage attack chains. Then we use a few-shot deep learning algorithm (SMOTE&CNN-SVM) and bidirectional recurrent neural network model (Bi-RNN) to obtain the feint attack chains. Feint attack is simulated by the real attack inserted in the normal causal attack chain, and the addition of the real attack destroys the causal relationship of the original attack chain. So, we used Bi-RNN coding to obtain the hidden feature of feint attack chain. In experiments, we evaluate our approach through using the LLDoS1.0 and LLDoS2.0 of DARPA2000 and CICIDS2017 of Canadian Institute for Cybersecurity.