Bidirectional RNN-based Few-shot Training for Detecting Multi-stage
  Attack
  "Feint Attack", as a new type of APT attack, has become the focus of
attention. It adopts a multi-stage attacks mode which can be concluded as a
combination of virtual attacks and real attacks. Under the cover of virtual
attacks, real attacks can achieve the real purpose of the attacker, as a
result, it often caused huge losses inadvertently. However, to our knowledge,
all previous works use common methods such as Causal-Correlation or Cased-based
to detect outdated multi-stage attacks. Few attentions have been paid to detect
the "Feint Attack", because the difficulty of detection lies in the
diversification of the concept of "Feint Attack" and the lack of professional
datasets, many detection methods ignore the semantic relationship in the
attack. Aiming at the existing challenge, this paper explores a new method to
solve the problem. In the attack scenario, the fuzzy clustering method based on
attribute similarity is used to mine multi-stage attack chains. Then we use a
few-shot deep learning algorithm (SMOTE&CNN-SVM) and bidirectional Recurrent
Neural Network model (Bi-RNN) to obtain the "Feint Attack" chains. "Feint
Attack" is simulated by the real attack inserted in the normal causal attack
chain, and the addition of the real attack destroys the causal relationship of
the original attack chain. So we used Bi-RNN coding to obtain the hidden
feature of "Feint Attack" chain. In the end, our method achieved the goal to
detect the "Feint Attack" accurately by using the LLDoS1.0 and LLDoS2.0 of
DARPA2000 and CICIDS2017 of Canadian Institute for Cybersecurity.
