Attack stage detection method based on vector reconstruction error autoencoder and explainable artificial intelligence

One of the most serious security threats faced by the Internet today is multi-stage attacks. In response to this challenge, anomaly detection-based methods have been widely used to identify different stages of such attacks. However, current anomaly detection approaches for detecting attack stages face several challenges: (1) Traditional methods often adopt a global perspective, lacking detailed consideration of the traffic characteristics at each stage, which may reduce the accuracy in detecting specific stages. (2) Many detection methods rely on deep learning models with complex internal structures, making their decision-making process opaque and difficult for users to interpret. This also complicates model optimization and improvement. To address these challenges, this paper proposes an attack stage detection method based on a vector reconstruction error autoencoder. By analyzing each stage independently, the proposed method enhances detection precision. It also integrates the permutation feature importance technique to quantify and interpret the model’s reliance on different features, guiding feature selection and model optimization. Experiments conducted using the CIC-IDS2017 and CSE-CIC-IDS2018 datasets demonstrate that the proposed method achieves higher accuracy, precision, recall, and F1 score compared to other methods, confirming its feasibility and effectiveness in detecting multi-stage attacks.