A Cyber-Attack Behavior Detection Model Based on Log Activity Graph

Host log contains rich semantic information, which is meaningful for cyber attack detection, cyber attack tracing and forensic. We propose a method that leverages the RoBERTa model to detect attack behavior. Our method models the problem of detecting cyber attacks based on host logs as a text classification problem in the field of natural language processing. The method involves constructing an activity graph to extract event sequences, which are then classified to identify attack. The proposed method achieves an accuracy of 98.6%. Additionally, we evaluate the effectiveness of our method on DARPA TC Program Engagement #3 dataset.