DeepChronos detects multi-step attacks with phase rules
Original title: DeepChronos: Temporal Neuro-Symbolic Reasoning for Multi-Step Attack Detection
On DARPA 2000 and AIT-LDS V2, authors report up to 11.3% higher macro F1 and no causal violations.
Researchers present DeepChronos, a neuro-symbolic intrusion detection system that combines flow-level evidence with attack-phase rules, temporal prerequisites, and previously inferred phases. The goal is to constrain each detection by attack history instead of correlating alerts only after independent classification. On DARPA 2000 and AIT-LDS V2, they report up to 11.3% higher macro F1 than neural baselines, no causal violations under strict temporal constraints, and millisecond-scale inference.
Unconfirmed: Accuracy and latency figures are author-reported on two datasets and are not independently verified here.
- The system uses explicit phase rules rather than post-alert correlation alone.
- Evaluations use DARPA 2000 and AIT-LDS V2.
- Authors report elimination of causal violations under strict temporal constraints.
- Inference latency is described as millisecond-scale.
- Products
- DeepChronos
- Organizations
- DARPA
From the original article
1 min read at arxiv.orgModern cyber threats commonly unfold as multi-step attacks comprising temporally and causally related phases. Current defenses commonly follow a detect first and correlate later paradigm. Intrusion detection systems classify events independently, while downstream systems reconstruct attack progression from the resulting alerts or audit records.
By Sofia Burkow · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.