Interpretable Attack-Chain Stage Detection from AWS CloudTrail Event Sequences via Linear Models and HMM Smoothing
DOI:
https://doi.org/10.33474/infotron.v6i1.24923Keywords:
CloudTrail, cloud audit logs, attack chain, MITRE ATT&CK, sequence modelingAbstract
Cloud audit logs such as AWS CloudTrail are a primary source of evidence for both incident response and compliance auditing, yet operational alerting still struggles with two coupled requirements: (i) recognizing multi-step cloud attacks from sequences of API events, and (ii) producing explanations that analysts and auditors can directly verify. This paper presents a reproducible and interpretable baseline pipeline for attack-chain stage detection from CloudTrail event sequences. Using the public Stratus Red Team AWS detonation logs (v2.23.2), a small labeled dataset containing 310 CloudTrail events across 35 AWS techniques and 10 ATT&CK tactics, we study three tasks: event-level tactic classification, windowed sequence classification, and attack-chain segmentation. Each CloudTrail event is encoded into a compact, schema-aware token set derived from native fields such as service, operation, principal type, management flags, and request/response key signatures, and transparent linear classifiers (TF-IDF + LinearSVC / logistic regression) are used to predict ATT&CK tactics. To recover a more coherent stage timeline, we smooth per-event predictions with a Hidden Markov Model (HMM) and Viterbi decoding using synthetic multi-stage chains assembled from the published technique traces. We further generate coefficient-based evidence reports that link predicted stages to high-weight events and feature tokens. On event-level tactic recognition, LinearSVC achieved 0.961 accuracy and 0.866 macro-F1. On synthetic multi-stage chains, LR + HMM improved boundary-F1 from 0.800 to 0.892, while accuracy and macro-F1 increased slightly from 0.840 to 0.848 and from 0.873 to 0.877, respectively. These results should be interpreted as a controlled public baseline rather than a production-ready estimate, but they show that simple and transparent models can provide useful stage-aware summaries and auditable evidence for cloud audit-log analysis.
References
[2] Amazon Web Services, "CloudTrail log file examples," AWS Documentation, 2024.
[3] Datadog, "Stratus Red Team (AWS detonation logs v2.23.2)," GitHub repository, 2025.
[4] Datadog, "Grimoire: CloudTrail Trickery for Red Teams," GitHub repository, 2024.
[5] Datadog, "LogLicker: CloudTrail Log Anonymizer," GitHub repository, 2024.
[6] MITRE, "ATT&CK Cloud Matrix," MITRE ATT&CK, 2025.
[7] National Institute of Standards and Technology, "Security and Privacy Controls for Information Systems and Organizations," NIST Special Publication 800-53 Rev. 5, 2020.
[8] National Institute of Standards and Technology, "Guide to Intrusion Detection and Prevention Systems (IDPS)," NIST Special Publication 800-94, 2007.
[9] L. R. Rabiner, "A tutorial on hidden Markov models and selected applications in speech recognition," Proc. IEEE, vol. 77, no. 2, pp. 257-286, 1989.
[10] C. Cortes and V. Vapnik, "Support-vector networks," Machine Learning, vol. 20, pp. 273-297, 1995.
[11] J. Lafferty, A. McCallum, and F. Pereira, "Conditional random fields: Probabilistic models for segmenting and labeling sequence data," in Proc. ICML, 2001.
[12] M. Du, F. Li, G. Zheng, and V. Srikumar, "DeepLog: Anomaly detection and diagnosis from system logs through deep learning," in Proc. ACM CCS, 2017.
[13] S. He, J. Zhu, P. He, and M. R. Lyu, "Drain: An online log parsing approach with fixed depth tree," in Proc. IEEE ICWS, 2017.
[14] W. Xu, L. Huang, A. Fox, D. Patterson, and M. Jordan, "Detecting large-scale system problems by mining console logs," in Proc. ACM SOSP, 2009.
[15] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, "BERT: Pre-training of deep bidirectional transformers for language understanding," in Proc. NAACL-HLT, 2019.
[16] M. T. Ribeiro, S. Singh, and C. Guestrin, ""Why should I trust you?": Explaining the predictions of any classifier," in Proc. ACM KDD, 2016.
[17] S. M. Lundberg and S.-I. Lee, "A unified approach to interpreting model predictions," in Proc. NeurIPS, 2017.
[18] Y. Liu, X. Wang, J. Wang, and H. Zhang, "LogBERT: Log anomaly detection via BERT," arXiv preprint arXiv:2103.04475, 2021.
[19] Open Cybersecurity Schema Framework, "OCSF Schema," OCSF Foundation, 2024.
[20] SigmaHQ, "Sigma: Generic Signature Format for SIEM Systems," GitHub repository, 2024.
[21] R. Patil, S. Muneeswaran, V. Sachidananda, and M. Gurusamy, “E-Audit: Distinguishing and investigating suspicious events for APTs attack detection,” Journal of Systems Architecture, vol. 144, Art. no. 102988, Nov. 2023, doi: 10.1016/j.sysarc.2023.102988.
[22] M. Keshk, N. Koroniotis, N. Pham, N. Moustafa, B. Turnbull, and A. Y. Zomaya, “An explainable deep learning-enabled intrusion detection framework in IoT networks,” Information Sciences, vol. 639, Art. no. 119000, Aug. 2023, doi: 10.1016/j.ins.2023.119000.
[23] I. H. Sarker, H. Janicke, A. Mohsin, A. Gill, and L. Maglaras, “Explainable AI for cybersecurity automation, intelligence and trustworthiness in digital twin: Methods, taxonomy, challenges and prospects,” ICT Express, vol. 10, no. 4, pp. 935–958, Aug. 2024, doi: 10.1016/j.icte.2024.05.007.
[24] B. Al-Sada, A. Sadighian, and G. Oligeri, “MITRE ATT&CK: State of the Art and Way Forward,” ACM Computing Surveys, vol. 57, no. 1, Art. no. 12, Oct. 2024, doi: 10.1145/3687300.
[25] W. Lin, J. Ma, T. Li, H. Ye, J. Zhang, and Y. Xiao, “CrptAC: Find the Attack Chain with Multiple Encrypted System Logs,” Electronics, vol. 13, no. 7, Art. no. 1378, Apr. 2024, doi: 10.3390/electronics13071378.
[26] M. Boffa, I. Drago, M. Mellia, L. Vassio, D. Giordano, R. Valentim, and Z. B. Houidi, “LogPrécis: Unleashing language models for automated malicious log analysis: Précis: A concise summary of essential points, statements, or facts,” Computers & Security, vol. 141, Art. no. 103805, Jun. 2024, doi: 10.1016/j.cose.2024.103805.
[27] Y. Chen, M. Cui, D. Wang, Y. Cao, P. Yang, B. Jiang, Z. Lu, and B. Liu, “A survey of large language models for cyber threat detection,” Computers & Security, vol. 145, Art. no. 104016, Oct. 2024, doi: 10.1016/j.cose.2024.104016.
[28] L. Ben-Shimol, D. Lavi, E. Klevansky, O. Brodt, D. Mimran, Y. Elovici, and A. Shabtai, “Detection of compromised functions in a serverless cloud environment,” Computers & Security, vol. 150, Art. no. 104261, Mar. 2025, doi: 10.1016/j.cose.2024.104261.
[29] J. Ren and R. Geng, “Provenance-based APT campaigns detection via masked graph representation learning,” Computers & Security, vol. 148, Art. no. 104159, Jan. 2025, doi: 10.1016/j.cose.2024.104159.
[30] Z. Weng, W. Zhang, T. Zhu, Z. Dou, H. Sun, Z. Ye, and Y. Tian, “RT-APT: A real-time APT anomaly detection method for large-scale provenance graph,” Journal of Network and Computer Applications, vol. 233, Art. no. 104036, Jan. 2025, doi: 10.1016/j.jnca.2024.104036.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Jingwen Bai, Siyu Chen, Daren Zheng, Meng-Ju Kuo
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
