Context-Aware Web Attack Detection in Open-Source SIEM Systems via MITRE ATT&CK-Enriched Behavioral Profiling

• URL: http://arxiv.org/abs/2605.13337v1
• Date: Wed, 13 May 2026 10:54:36 GMT
• Title: Context-Aware Web Attack Detection in Open-Source SIEM Systems via MITRE ATT&CK-Enriched Behavioral Profiling
• Abstract summary: We present Smart-SIEM, an AI module for the open-source Wazuh SIEM platform.<n>A behavioural context vector encoding HTTP response-status distributions is used.<n>A two-stage hybrid cascade combines LightGBM for binary attack detection and XGBoost for six-class attack categorisation.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Security Information and Event Management (SIEM) systems aggregate log data from heterogeneous sources to detect coordinated attacks. Traditional rule-based correlation engines struggle to classify multi-step web application attacks because they examine each event without reference to the behavioural history of the originating host. We present Smart-SIEM, an AI module for the open-source Wazuh SIEM platform with two contributions: (1) a per-source-IP behavioural context vector encoding HTTP response-status distributions, peak rule activation counts, and MITRE ATT&CK technique frequencies from the N most recent prior events; (2) a two-stage hybrid cascade combining LightGBM for binary attack detection and XGBoost for six-class attack categorisation. Evaluated on 46,454 purpose-built Wazuh security events, context features improve all tested gradient boosting algorithms from ~0.705 macro F1 to 0.947-0.967 (Stage 1) and 0.876-0.914 (Stage 2), an average gain of +0.254 and +0.324 respectively. The hybrid cascade achieves F1 of 0.967 (binary) and 0.914 (six-class). Wazuh's native rule engine detects 0% of Brute Force and Broken Authentication events; the AI module detects 100% and 98.3% respectively. A self-adaptive retraining mechanism recovers from concept drift: F1 drops from 0.905 to 0.465 when unseen attack types emerge, recovering to 0.814 after retraining on the combined corpus.

Related papers

• AttackPathGNN: Cross-function vulnerability detection in smart contracts using state interference graphs and conjunction pooling [3.8615905456206256]
  Existing learning-based detectors for Solidity smart-contracts reduce vulnerability detection to pattern matching within single functions.<n>We propose AttackPathGNN, a graph neural network (GNN) that reframes detection as reasoning over explicit attack paths.
  arXiv  Detail & Related papers  (2026-06-04T10:30:24Z)
• Improving IoT Intrusion Detection Through SMOTE-Based Oversampling and Extended Multi-Model Evaluation on Side-Channel Power Data [0.0]
  This paper deals with the problem of imbalance in the side-channel dataset for power-based intrusion detection.<n>Random Forest reached a micro-averaged F1 score of 0.9989 and macro F1 of 0.9794, outperforming the previously best micro-F1 result.<n>Extra Trees provided the same performance as well, but at 10 times faster.
  arXiv  Detail & Related papers  (2026-05-29T10:10:13Z)
• Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection [0.0]
  This work proposes seven detection techniques that each port a specific mechanism from a discipline outside large-language--model security.<n>Three of the seven techniques are implemented in the prompt-shield v0.4.1 release (Apache 2.0) and evaluated in a four-configuration ablation across six datasets.
  arXiv  Detail & Related papers  (2026-04-20T13:27:05Z)
• AnomalyGen: Enhancing Log-Based Anomaly Detection with Code-Guided Data Augmentation [42.87177529900358]
  AnomalyGen is a novel framework that augments training data by synthesizing labeled log sequences from source code.<n> Evaluations on HDFS and Zookeeper across 12 diverse anomaly detection models show AnomalyGen consistently improves performance.
  arXiv  Detail & Related papers  (2026-04-13T07:24:43Z)
• CLASP: Defending Hybrid Large Language Models Against Hidden State Poisoning Attacks [48.54598003197356]
  State space models (SSMs) like Mamba have gained significant traction as efficient alternatives to Transformers.<n>HiSPAs, a recently discovered vulnerability that corrupts SSM memory through adversarial strings, pose a critical threat to these architectures.<n>We introduce the CLASP model to defend against this threat.
  arXiv  Detail & Related papers  (2026-03-12T17:29:55Z)
• MI$^2$DAS: A Multi-Layer Intrusion Detection Framework with Incremental Learning for Securing Industrial IoT Networks [47.386868423451595]
  MI$2$DAS is a multi-layer intrusion detection framework that integrates anomaly-based hierarchical traffic pooling and open-set recognition.<n>Experiments conducted on the Edge-IIoTset dataset demonstrate strong performance across all layers.<n>These results showcase MI$2$DAS as an effective, scalable and adaptive framework for enhancing IIoT security.
  arXiv  Detail & Related papers  (2026-02-27T09:37:05Z)
• Enhancing Continual Learning for Software Vulnerability Prediction: Addressing Catastrophic Forgetting via Hybrid-Confidence-Aware Selective Replay for Temporal LLM Fine-Tuning [43.24339861841546]
  This paper investigates fine-tuning of a decoder-style language model (phi/phi-2 with LoRA) on a CVE-linked dataset.<n>We evaluate eight continual learning strategies, including window-only and cumulative training, replay-based baselines and regularisation-based variants.<n>Hybrid-CASR reduces training time per window by about 17 percent compared to the baseline, whereas cumulative training delivers only a minor F1 increase (0.661) at a 15.9-fold computational cost.
  arXiv  Detail & Related papers  (2026-02-27T09:13:23Z)
• Benchmarking IoT Time-Series AD with Event-Level Augmentations [34.864214444544565]
  We introduce an evaluation protocol with unified event-level augmentations that simulate real-world issues.<n>We evaluate 14 representative models on five public anomaly datasets.
  arXiv  Detail & Related papers  (2026-02-17T09:45:44Z)
• Generative Active Adaptation for Drifting and Imbalanced Network Intrusion Detection [14.728689487990836]
  generative active adaptation framework minimizes labeling effort while enhancing model robustness.<n>We evaluate our end-to-end framework NetGuard on both simulated IDS data and a real-world ISP dataset.
  arXiv  Detail & Related papers  (2025-03-04T21:49:42Z)
• Deep Autoencoders for Unsupervised Anomaly Detection in Wildfire Prediction [42.447827727628734]
  Wildfires pose a significantly increasing hazard to global ecosystems due to the climate crisis. Due to its complex nature, there is an urgent need for innovative approaches to wildfire prediction, such as machine learning. This research took a unique approach, differentiating from classical supervised learning, and addressed the gap in unsupervised wildfire prediction.
  arXiv  Detail & Related papers  (2024-11-14T23:19:55Z)
• Sample Efficient Detection and Classification of Adversarial Attacks via Self-Supervised Embeddings [40.332149464256496]
  Adrial robustness of deep models is pivotal in ensuring safe deployment in real world settings. We propose a self-supervised method to detect adversarial attacks and classify them to their respective threat models. We use a SimCLR encoder in our experiments, since we show the SimCLR embedding distance is a good proxy for human perceptibility.
  arXiv  Detail & Related papers  (2021-08-30T16:39:52Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.