Addressing Multi-Stage Attacks Using Expert Knowledge and Contextual Information - camera ready.pdf (1.16 MB)

Addressing multi-stage attacks using expert knowledge and contextual information

Download (1.16 MB)
conference contribution
posted on 04.02.2019, 14:02 by Francisco J. Aparicio-Navarro, Timothy Chadza, Kostas Kyriakopoulos, Ibrahim Ghafir, Sangarapillai Lambotharan, Basil AsSadhan
New challenges in the cyber-threat domain are driven by tactical and meticulously designed Multi-Stage Attacks (MSAs). Current state-of-the-art (SOTA) Intrusion Detection Systems (IDSs) are developed to detect individual attacks through the use of signatures or identifying manifested anomalies in the network environment. However, an MSA differs from traditional one-off network attacks as it requires a set of sequential stages, whereby each stage may not be malicious when manifested individually, therefore, potentially be underestimated by current IDSs. This work proposes a new approach towards addressing this challenging type of cyber-attacks by employing external sources of information, beyond the conventional use of signatures and monitored network data. In particular, both expert knowledge and contextual information in the form of Pattern-of-Life (PoL) of the network are shown to be influential in giving an advantage against SOTA techniques. We compare our proposed anomaly-based IDS, based on decision making powered by the Dempster-Shafer (D-S) Theory and Fuzzy Cognitive Maps (FCMs), against Snort, one of the most widely deployed IDS in the world. Our results verify that the use of contextual information improves the efficiency of our IDS by enhancing the Detection Rate (DR) of MSAs by almost 50%.


This work has been supported by the Gulf Science, Innovation and Knowledge Economy Programme of the UK Government under UK-Gulf Institutional Link grant IL 279339985.



  • Mechanical, Electrical and Manufacturing Engineering

Published in

22nd Conference on Innovation in Clouds, Internet and Networks (ICIN 2019)


APARICIO-NAVARRO, F.J. ... et al., 2019. Addressing multi-stage attacks using expert knowledge and contextual information. Presented at the 22nd Conference on Innovation in Clouds, Internet and Networks (ICIN 2019), Paris, 19-21 February, pp.188-194.




AM (Accepted Manuscript)

Acceptance date


Publication date



© 2019 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.