Real-Time Detection of Multi-Stage Attacks Using Kill Chain State Machines

Cyber threats present an ongoing challenge for organisations worldwide. Attackers range from cybercriminals to state-funded groups that have a specialised skill set to execute complex attacks and present an Advanced Persistent Threat (APT). Therefore, organisations use security monitoring as a second line of defence to detect attacks based on signatures that raise alarms when an Indicator of Compromise (IoC) is observed. However, current Intrusion Detection Systems (IDS) generate many false positives, leading to alert fatigue. The raised alerts also do not show the whole attack as they need to be reviewed individually. Our work presents a simplified approach that enables efficient and real-time construction of attacks by correlating alerts. Tests with different network datasets suggest that our prioritisation mechanisms can reduce the number of false-positive alerts by 99 %. Our performance evaluation indicates that we can detect multi-stage attacks in real-time with a low memory footprint and short execution time.