\documentclass[final,5p,twocolumn]{elsarticle}


%% Use the option review to obtain double line spacing
%% \documentclass[authoryear,preprint,review,12pt]{elsarticle}

%% Use the options 1p,twocolumn; 3p; 3p,twocolumn; 5p; or 5p,twocolumn
%% for a journal layout:
%% \documentclass[final,1p,times,authoryear]{elsarticle}
%% \documentclass[final,1p,times,twocolumn,authoryear]{elsarticle}
%% \documentclass[final,3p,times,authoryear]{elsarticle}
%% \documentclass[final,3p,times,twocolumn,authoryear]{elsarticle}
%% \documentclass[final,5p,times,authoryear]{elsarticle}
%% \documentclass[final,5p,times,twocolumn,authoryear]{elsarticle}

%% For including figures, graphicx.sty has been loaded in
%% elsarticle.cls. If you prefer to use the old commands
%% please give \usepackage{epsfig}

%% The amssymb package provides various useful mathematical symbols
\usepackage{amssymb}
%% The amsmath package provides various useful equation environments.
\usepackage{amsmath}
%% The amsthm package provides extended theorem environments
%% \usepackage{amsthm}

%% The lineno packages adds line numbers. Start line numbering with
%% \begin{linenumbers}, end it with \end{linenumbers}. Or switch it on
%% for the whole article with \linenumbers.
%% \usepackage{lineno}
\usepackage[table]{xcolor} 
\usepackage[utf8]{inputenc}
\usepackage{graphicx}
\usepackage{booktabs}
\usepackage{caption}
\usepackage{subcaption}
\usepackage{amsmath}
\usepackage{geometry}
\usepackage{hyperref}
\usepackage{enumitem}
\usepackage{fancyvrb}
\usepackage{rotating}
\usepackage{float}
\usepackage{changepage}
\usepackage{adjustbox}
\usepackage{longtable}
\usepackage{tabularx}
\usepackage{tikz}
\usepackage[edges]{forest}
\usepackage{array}       
\usepackage{ragged2e}   
\usepackage{rotating} % For sidewaysfigure
\usepackage{tikz}
\usetikzlibrary{arrows.meta, positioning, shapes.geometric}
\usepackage{placeins}
\usetikzlibrary{positioning}
\usepackage{changepage}   % for adjustwidth
\usepackage{fancyvrb}     % for VerbatimInput with options
\usepackage{cuted}
\usepackage{fvextra}
\usepackage{listings}


\usepackage{natbib}
\usetikzlibrary{arrows.meta, positioning, shapes.geometric}
% \usepackage[margin=1in]{geometry}


\newcolumntype{L}{>{\raggedright\arraybackslash}X}

\tikzstyle{process} = [
    rectangle, 
    minimum width=3cm, 
    minimum height=1cm, 
    text centered, 
    draw=black, 
    font=\small, 
    fill=blue!10
]
\tikzstyle{decision} = [
    diamond, 
    aspect=1.5, 
    minimum width=2.8cm, 
    minimum height=1cm, 
    text centered, 
    draw=black, 
    font=\small, 
    fill=red!10
]
\tikzstyle{arrow} = [thick,->,>=Stealth]

\RecustomVerbatimEnvironment{Verbatim}{Verbatim}{fontsize=\small}
\bibliographystyle{elsarticle-num}
\begin{document}

\begin{frontmatter}

\title{A Phased Graph Convolutional Network Framework for Multi-Step Attack Detection: Event-Log Correlation and Heterogeneous Dataset Evaluation (Replication \& Extensions)}

\author[1]{S.~U.~Shaukat\corref{cor1}}
\author[1]{Saad Khan}
\author[1]{Simon Parkinson}

\address[1]{%
  University of Huddersfield, School of Computing and Engineering,\\
  Queensgate, Huddersfield HD1 3DH, United Kingdom%
}

\cortext[cor1]{Corresponding author. Email: syedusman.shaukat@hud.ac.uk}


%% Abstract
\begin{abstract}
%% Text of abstract
Multi-Step Attack Detection (MSAD) continues to pose a significant issue in cybersecurity owing to the intricacy of attack sequences and the diversity of log sources.  This study presents a modular and extendable detection pipeline utilising Graph Convolutional Networks (GCNs) that facilitates multi-phase attack categorisation and integrated log parsing.  We initially replicate a contemporary model for Advanced Persistent Threat (APT) detection utilising the CTU-13 dataset, attaining an F1-score of 100\%, hence verifying the baseline.  We expand the architecture through four phases: accurately detecting Distributed Denial-of-Service (DDoS) attacks with a custom logset at 100\% accuracy; generalising to botnet detection on CTU-13—enhancing previous results (F1: 95.4\%) to achieve 100\% accuracy and F1-score; and creating a modular parser adept at processing various log types, including Sysmon, Event Logs, Firewall Logs, Performance Logs, and Registry Dumps. In Phase 3, the model attains 99.99\% accuracy and F1-score in botnet detection.  We further improved these methods to improve distinctiveness and illustrate the development of attacks.  The concluding benchmark phase attains 99.88\% accuracy and 99.89\% F1-score, validating generalisability over diverse logs.  Our phased detection pipeline provides versatility across datasets and formats (addressing heterogeneity), promoting scalable MSAD with elevated precision and recall, while ensuring repeatability for practical implementation.
\end{abstract}

%%Graphical abstract
% \begin{graphicalabstract}
%\includegraphics{grabs}
% \end{graphicalabstract}

%% Keywords
\begin{keyword}
%% keywords here, in the form: keyword \sep keyword

%% PACS codes here, in the form: \PACS code \sep code

%% MSC codes here, in the form: \MSC code \sep code
%% or \MSC[2008] code \sep code (2000 is the default)

Graph Convolutional Networks (GCN) \sep Multi-Step Attack Detection \sep Event-Log Correlation \sep APT Detection \sep DDoS Detection \sep Botnet Detection \sep Heterogeneous Datasets

\end{keyword}

\end{frontmatter}

%% Add \usepackage{lineno} before \begin{document} and uncomment 
%% following line to enable line numbers
%% \linenumbers

%% main text
%%
%% Use \section commands to start a section

\section{Introduction}

Advanced Persistent Threats (APTs) and multi-step attacks represent a significant challenge in cybersecurity due to their distributed and stealthy nature. These attacks often involve sequences of seemingly benign actions that, when correlated, form a malicious trajectory. Traditional rule-based or signature-driven detection methods fall short in modelling such chained behaviours, motivating the use of graph-based techniques that can learn inter-event relationships over time and across contexts.

\begin{sloppypar}
Graph Convolutional Networks (GCNs) offer a promising mechanism for detecting multi-step attacks by learning representations over event or flow graphs. In this context, \cite{Nguyen} proposed a notable approach for APT detection using GCNs, wherein causal inferences among flow-level events were leveraged to classify attack behaviours on the CTU-13 dataset. Their method demonstrated that GCNs can effectively capture latent structures in flow data to distinguish between benign and malicious activity.
\end{sloppypar}

\vspace{1em}
\noindent \textbf{Why we chose this paper for replication:}  
We selected this paper because it sits at the intersection of explainability, reproducibility, and real-world applicability. The original GCN-based model is modular and interpretable, yet limited in scope—it only evaluated a single dataset (CTU-13 APT) and did not consider diverse data types such as event logs or host-level telemetry. As researchers focused on Multi-Step Attack Detection (MSAD) via event log correlation, replicating this paper allows us to test whether GCNs can be effectively applied to richer and more heterogeneous sources.

\vspace{1em}
\noindent \textbf{Strategic benefits for our MSAD research:}  
Replicating and extending this work enables us to investigate the utility of graph-based methods not just for APTs, but for a broader range of attack vectors (e.g., DDoS, botnets). By systematically expanding the model across phases, we evaluate GCN generalisability, assess modular training across datasets, and build a reusable experimental pipeline for future studies in event log correlation.
\noindent \textbf{Overview of Our Multi-Phase Approach:}
Our research adheres to a four-phase framework: we commence by recreating the initial replication process of \cite{Cuong} on the CTU-13 dataset, then enhancing the pipeline to incorporate heterogeneous Windows event logs for DDoS detection.  The next two phases extend to botnet and DoS-style datasets (CTU-13 Botnet and CICIDS2017) and incorporate semantic feature engineering for enhanced analysis and comprehensive generalisation/validation.  All processes are executed within a modular, restartable pipeline powered by a modular log parser, engineered for reproducibility and future extensibility.
\noindent  This phase-wise detection approach supports our overarching objective: to assess the versatility of graph-based models across various attack types, data sources and the diversity.  By organising our efforts into modular phases, we facilitate systematic testing, improve interpretability, and establish a foundation for scalable, practical MSAD solutions.
\subsection{Our Contributions}
To address the challenge of detecting multi-step cyberattacks across heterogeneous environments, this work makes the following key contributions:
    \paragraph{Replication and Validation:} We replicate a baseline Graph Convolutional Network (GCN)-based inference model for detecting Advanced Persistent Threats (APTs) using the CTU-13 dataset. Our replication achieves an F1-score of 100\%, supporting the original method's validity.

    \paragraph{Multi-Phase Detection Pipeline:} We extend the original GCN pipeline to multiple phases, each targeting a distinct attack scenario:
        \subparagraph{Phase 2:} Detection of Distributed Denial-of-Service (DDoS) attacks using a custom Windows logset, composed of heterogeneous log files. Our model achieves 100\% accuracy in this phase.
       \subparagraph{Phase 3:} Detection of botnet activity using the CTU-13 dataset, showing high generalisation with an F1-score of 100\%.
        \subparagraph{Phase 4:} Latent Semantic Analysis (LSA)-based transformation of log features for semantic similarity enhancement and attack stage separation. Visualisation is supported using dimensionality reduction techniques.

\paragraph{Modular Log Parser for Heterogeneous Data:} We develop a modular parser capable of ingesting and converting diverse security log types, including Sysmon logs, Windows Security logs, Firewall logs, Registry dumps, Task Schedulers, Performance Monitor CSVs, and structured TXT/EVTX logs. This parser supports plug-in modules for future extension to other formats such as Zeek, Snort, or Suricata.

\paragraph{Automation and Scalability:} The modular GCN pipeline is designed for automation and is scalable across varying attack types and data formats. It supports seamless integration of future detection stages and log sources.

\paragraph{Benchmarking and Reproducibility:} We provide a structured evaluation of our pipeline across all phases with quantitative metrics (accuracy, F1-score) and qualitative visualisations. The entire implementation, datasets, and results are reproducible and suitable for benchmarking in real-world MSAD (Multi-Step Attack Detection) research.

These contributions collectively demonstrate a comprehensive graph-based framework capable of handling heterogeneous log inputs to detect a range of complex cyberattacks.

\paragraph{Structure of the Paper.}
This article is structured as follows: Section~\ref{sec:methodology} describes the replicated and modular GCN architecture and outlines the phase-wise experimental pipeline. Section ~\ref{sec:related_work} discusses MSAD research focusing on event log correlation using graph-based methods. Section~\ref{sec:datasets} presents the datasets used and explains the log parsing and unification strategy adopted across custom and public datasets. Section~\ref{sec:results} reports on classification outcomes, visualisations, and quantitative evaluations across all experimental phases. Section~\ref{sec:enhancements} discusses system-level design considerations, parser generalisability, and future extensions for real-time MSAD pipelines. Section ~\ref{GB-MSAD-challenges} discussed MSAD research challenges in conjunction with graph-based methods.Finally, Section~\ref{sec:conclusion} summarises the overall contributions and highlights key directions for future work using graph-based models in multi-step attack detection.

\section{Research Methodology}
\label{sec:methodology}
\subsection{Overall Approach}
This study adopts a replication-plus-extension methodology inspired by a previously published GCN model for APT detection. The research objective was twofold: (1) to validate the original experiment using the CTU-13 dataset and inference-based graph convolutional classification, and (2) to generalise its utility by developing a modular GCN pipeline capable of detecting multiple attack types, including DDoS and botnets, using both public and custom log-based datasets. Our contributions particularly focus on modularising the graph-based learning process and unifying heterogeneous logs into a consistent format suitable for training.

\subsection{GCN Architecture}
A two-layer Graph Convolutional Network (GCN) architecture was implemented using PyTorch and PyTorch Geometric. For each training phase, a sparse k-NN graph was constructed using standardised feature vectors, where $k=10$. Feature preprocessing was performed using \texttt{StandardScaler}, and neighbourhood graphs were generated using \texttt{kneighbors\_graph} from the \texttt{scikit-learn} library. The adjacency matrices were stored in sparse format and converted to PyG-compatible \texttt{edge\_index} representations for use in the model.

\subsection{Phase-wise Modular Workflow}
The GCN-based detection pipeline was structured into multiple modular phases, enabling plug-and-play experimentation with different datasets, features, and attack types:

\subsubsection*{Phase 1 (Replication - APT Detection):} Reproduced original work using CTU-13 dataset to detect Advanced Persistent Threats (APTs).
\subsubsection*{Phase 2 (Custom Logset - DDoS Detection):} Extended the model to process our heterogeneous custom logset from Windows 10 and Server 2019, detecting DDoS patterns via feature extraction and modular parsing.
\subsubsection*{Phase 3 (CTU-13 - Botnet Detection):} Generalised pipeline back to CTU-13 to classify botnet activity using alternative labels and feature views.
\subsubsection*{Phase 4 (Unified Parser Framework):} Developed a scalable, modular parser that supports multiple log formats (e.g., ".evtx", ".log", ".txt", ".csv") and extracts common fields such as timestamps, IPs, ports, protocols, PIDs, and system events.
    \subsubsection*{Phase 5 (Log Semantic Augmentation - LSA):} Explored semantic enrichment of event logs and visualised GCN prediction outputs using dimensionality reduction and confidence probabilities. 

\subsection{Log Parsing and Feature Engineering}
Our modular parser is capable of ingesting logs from different sources (e.g., Sysmon, firewall, network traffic, Windows Event Logs, and Defender logs- Figure ~\ref{fig:modular_parser1}), and transforms these into structured CSV files containing unified fields. \newline \newline
Key steps included:

The log pre-processing phase consisted of three essential components.  Initially, log timestamps and event identifiers were standardised across several formats to guarantee temporal consistency and schema conformity.  Secondly, we retrieved quantitative and qualitative features from the heterogeneous log files to facilitate graph generation in subsequent steps.  Ultimately, label assignment to events according to post-attack indicators or the dataset's ground truth, thus facilitating supervised learning for attack detection.

\subsection{Visualisation and Evaluation}
For each phase, the following visualisation and evaluation components were generated to measure performance and interpret model decisions. (1) PCA projections for feature separability (Figures~\ref{fig:pca1}--\ref{fig:pca4}). (2)  Confusion matrices and label distribution analysis (Figure~\ref{fig:gcn-comparison}). (3) Metric comparison across all phases, including Accuracy, Precision, Recall, and F1-score (Table~\ref{tab:cosine_vs_knn}).

\subsection{PRISMA-Based Review Protocol: Graph-Based Techniques for MSAD}
\label{sec:prisma}
This article builds upon a broader systematic review of 348 articles on multi-step attack detection via event log correlation. From that, 154 articles were selected for in-depth review. In the present work, we refine our focus to 36 studies employing graph-based detection techniques within this domain.

\subsubsection{Objectives}
This systematic review aims to identify, classify, and critically assess graph-based detection methods employed for Multi-Step Attack Detection (MSAD). The key research questions include:

\begin{itemize}
  \raggedright
  \item What types of graph-based techniques (e.g., GNNs, attack graphs, probabilistic graphs) have been used in MSAD research?
  \item Which datasets are commonly used to evaluate these techniques?
  \item What are the reported performance metrics and identified limitations in the reviewed studies?
\end{itemize}


\begin{figure*}[!htb]
\centering
\begin{tikzpicture}[node distance=1.2cm and 1.6cm]

\node (id) [process] {\shortstack{Database records\\identified\\(n = 304)}};
\node (other) [process, right=of id] {\shortstack{Other sources\\(n = 44)}};
\node (dup) [process, below=of other] {\shortstack{After duplicates\\removed\\(n = 34)}};
\node (screen) [process, left=of dup] {\shortstack{Records\\screened\\(n = 314)}};
\node (exclude1) [decision, below=of screen] 
  {\shortstack{Excluded\\(title/abstract)\\(n = 125)}};

\node (fulltext) [process, right=1.0cm of exclude1] {\shortstack{Full-text\\assessed\\(n = 189)}};
\node (exclude2) [decision, right=2.7cm and 1.0cm of fulltext] 
  {\shortstack{Full-text\\excluded\\(n = 153)}};
\node (include) [process, below=of fulltext] {\shortstack{Qualitative\\synthesis\\(n = 36)}};
\node (final) [process, below=of include] {\shortstack{Included in\\data extraction\\(n = 36)}};

\draw [arrow] (id) -- (other);
\draw [arrow] (other) -- (dup);
\draw [arrow] (dup) -- (screen);
\draw [arrow] (screen) -- (exclude1);
\draw [arrow] (exclude1) -- (fulltext);
\draw [arrow] (fulltext) -- (include);
\draw [arrow] (include) -- (final);
\draw [arrow] (fulltext.east) -- (exclude2.west);

\end{tikzpicture}
\caption{PRISMA 2020-style flow diagram }
\label{fig:prisma_flow}
\end{figure*}

\subsubsection{Eligibility Criteria}
\textbf {Inclusion criteria:} The inclusion criteria for this review were as follows: Studies needed to clearly use graph-based models for Multi-Step Attack Detection (MSAD); they had to be peer-reviewed articles published in journals or conference proceedings from 2008 to 2024, and they were expected to include important information like the datasets used, detection accuracy or F1-score (performance measures), pros, cons, limitations, and any mentioned research challenges.

\textbf{Exclusion criteria:} Studies were omitted if they concentrated exclusively on detection techniques without integrating graph-based structures. Furthermore, incomplete and non-English/peer-reviewed articles were also omitted from consideration. Ultimately, studies based on graph theory that do not pertain to cybersecurity or MSAD were considered ineligible for inclusion. To refine the scope, we pinpointed articles that primarily concentrate on detection methods utilising event log correlation techniques.

\subsubsection{Information Sources}
The literature search was carried out across five major databases like IEEE Xplore, SpringerLink, the ACM Digital Library, and ScienceDirect (Elsevier). Additionally, Google Scholar was also used to identify grey literature and support the cross-verification of retrieved studies.

\subsubsection{Search Strategy}
A structured query was applied combining Boolean operators:
\noindent\texttt{("graph neural network" OR "attack graph" OR "graph mining" OR "factor graph") AND}\\
\texttt{("multi-step attack" OR "MSAD" OR "event correlation" OR "multi-stage attack")}

\begin{figure*}[!htb]
    \centering
    \includegraphics[width=0.75\linewidth]{dataset_insights.png}
    \caption{Datasets used for graph-based event log correlation for MSAD}
    \label{fig:dataset_insights}
\end{figure*}

\begin{figure*}[!htbp]
    \centering
    \includegraphics[width=0.75\linewidth]{citation_insights.png}
    \caption{Reported performances in graph-based event log correlation-MSAD studies}
    \label{fig:citation_insights}
\end{figure*}

\begin{table*}[!htbp]
\scriptsize
\centering
\captionsetup{type=table}
\caption{Summary of Graph-Based Techniques for MSAD}
\label{tab:graph_based_msad}
\begin{tabularx}{\textwidth}{
    >{\raggedright\arraybackslash}X 
    >{\raggedright\arraybackslash}X 
    >{\raggedright\arraybackslash}X 
    >{\raggedright\arraybackslash}X 
    >{\raggedright\arraybackslash}X
}
\toprule
\textbf{Study} & \textbf{Technique} & \textbf{Dataset} & \textbf{Accuracy/F1} & \textbf{Key Limitation} \\
\midrule
\cite{Friji} & GNN + RF + RNN & ToN IoT & F1: 94\% & Limited to IoT; No generalisation \\
\cite{Cuong} & Explainable GNN & CTU-13 & Accuracy: 99\% & Single dataset; Static features \\
\cite{ChenS} & Temporal-Gated GNN + GRU & UNSW-NB15 & Accuracy: 95.14\% & High computational cost \\
\cite{xu-k} & Bayesian Subgraphs + Clustering & Simulated & High TDVC & Manual vectorisation; No scalability test \\
\cite{zhuang} & Graph Mining + Alert Fusion & DARPA & Reduced FPs & Outdated dataset \\
\cite{zhang} & HMM + Factor Graphs & DARPA & FP↓ 96\% & No scalability evidence \\
\cite{xu-b} & Causal Graph Mining & DARPA & Not Stated & Limited validation \\
\cite{Alserhani} & Alert Aggregation via Graphs & DARPA & Reduced FPs & No real-time testing \\
\cite{Wang-a} & Causal Attack Graphs & Not specified & Alerts↓ 90\% & No runtime analysis \\
\cite{Yuen} & Attack Path Visualisation & Not specified & Not provided & No performance metrics \\
\cite{Li} & Dual-Domain Graph-Based & LLDDOS1.0 & High F1 & No scalability check \\
\cite{Tian2019} & Bayesian Attack Graphs & Simulated & High Accuracy & No real-world testing \\
\bottomrule
\end{tabularx}
\end{table*}


\subsubsection{Study Selection Process}
All records were initially screened for relevance through title and abstract analysis. Duplicates were removed before screening. The remaining 314 articles underwent abstract review, and 125 were excluded for irrelevance or lack of graph-based focus. Subsequently, 189 full-text articles were assessed based on the predefined eligibility criteria. Of these, 36 studies met the inclusion requirements and were selected for qualitative synthesis and data extraction, as detailed in Figure~\ref{fig:prisma_flow}.

\subsubsection{Data Extraction and Items}
From each selected study, the following data were extracted: the authors, year of publication, and venue; the type of graph-based technique employed (such as Graph Neural Networks or Bayesian sub-graph models etc.); their relevance to ELC-MSAD, the dataset or datasets utilised; the performance metrics reported, including accuracy and F1-score; and any identified pros, cons, limitations and reported challenges, such as scalability issues, limited generalisability, or dataset-specific constraints.

\subsubsection{Synthesis and Summary}
Visual summaries complemented a narrative synthesis. Table~\ref{tab:graph_based_msad} overviews the techniques, datasets, and outcomes reported across studies. Figure~\ref{fig:dataset_insights} illustrates the frequency of dataset usage, while Figure~\ref{fig:citation_insights} presents a comparative view of the reported performance metrics.

\subsubsection{Findings from Systematic Review: Strengths and Gaps in the Literature}
Graph-based approaches have become increasingly prominent in the domain of Multi-Step Attack Detection (MSAD), owing to their capacity to model interdependencies between events and represent complex sequences of malicious behaviour. These techniques encompass the use of Graph Neural Networks (GNNs), probabilistic graphical models, and various forms of graph mining to enhance detection accuracy and reduce false positives.

Several studies have demonstrated the effectiveness of GNN-based models. For instance, a hybrid approach integrating GNNs with Random Forest and RNN was evaluated on the ToN IoT dataset, achieving a F1-score of 94\% \cite{Friji}. Although effective within the IoT domain, its generalisability to broader, non-IoT datasets was not assessed. Another study introduced explainable GNNs for analysing malware communication in the CTU-13 dataset, reporting up to 99\% accuracy \cite{Cuong}. Despite the high performance, the use of a single dataset and reliance on static features limited the model’s robustness.

Temporal modelling has also been explored through gated GNNs coupled with GRU layers, which captured sequential dependencies in the UNSW-NB15 dataset with an accuracy of 95.14\% \cite{ChenS}. However, the computational complexity of this architecture poses scalability concerns in real-time detection scenarios.

Bayesian approaches have been employed to generate attack subgraphs for pattern identification. One such method showed high detection value coverage (TDVC) by leveraging clustering \cite{xu-k}, though it required manual vectorisation and lacked validation on large-scale or dynamic datasets. Similar probabilistic methods using factor graphs combined with Hidden Markov Models (HMMs) demonstrated a 96\% reduction in false positives \cite{zhang}, yet the study did not address operational scalability or execution time.

Graph mining techniques for event correlation have also been widely explored. Several earlier works structured alerts into causal or aggregated graph representations using datasets such as DARPA \cite{zhuang, xu-b, Alserhani}. While these frameworks notably reduced false alarms, they often lacked real-time testing or adaptation to modern environments. Causal reasoning via attack graphs has proven beneficial for modelling attack paths, with some studies reporting reductions in alert volumes of up to 90\% \cite{Wang-a}. Nevertheless, these systems often omitted performance metrics and real-world validation.

Visualisation-based graph techniques were also introduced to enhance the interpretability of attack sequences. One such framework illustrated multi-step attack paths but did not provide measurable outcomes related to detection efficacy or computational feasibility \cite{Yuen}. Recent contributions have combined dual-domain defence strategies with graph-based models, achieving high F1-scores on datasets like LLDDOS1.0 \cite{Li}. Yet, the absence of scalability analysis remains a critical gap.

A comparative summary of these graph-based MSAD techniques, along with datasets, reported metrics, and key limitations, is presented in Table~\ref{tab:graph_based_msad}. While existing work underscores the promise of graph-based methods for MSAD, common limitations persist. These include over-reliance on outdated or simulated datasets, lack of runtime evaluation, and challenges in scaling to heterogeneous environments. The proposed modular GCN-based framework in this study directly addresses these gaps by focusing on real-world log correlation, scalability, and generalisability across varied attack scenarios.

Graph-based MSAD approaches show significant promise but require more rigorous, scalable, and real-world validated methodologies. Our review supports the case for building robust detection systems using flexible graph-based models evaluated across diverse, up-to-date datasets.

\subsubsection{Overview and Selection Justification of Replicated Study}

The foundational study for our replication is "Using Inference and Graph Convolutional Networks for APT Attack Detection" \textbf{\cite{Cuong}}, which proposed a machine learning-driven classification approach for Advanced Persistent Threats (APTs) using the CTU-13 dataset. The original work combined inference models with deep learning techniques to classify flow-level network events, emphasising accuracy and explainability through handcrafted features and interpretable classification layers.

\textbf{Strengths of the Original Study:} The initial study demonstrated the potential of integrating inference processes with deep learning (DL) for Advanced Persistent Threat (APT) identification. The utilisation of interpretable features and a replicable three-layer methodology rendered it a strong candidate for further extension (research motivation). Furthermore, the CTU-13 dataset provided a well-scoped basis for comparative experimentation and comprehensive validation. 

\textbf{Limitations Addressed and Extensions Introduced in Our Study:} Our research builds upon this foundation while addressing key limitations in scope and applicability (Section 5 shows research challenges with our contribution). The initial study concentrated exclusively on APT detection and did not investigate its applicability to other MSA threat categories, like Distributed Denial-of-Service (DDoS) or botnet detection (Phases 2, 3, and 4). We broaden this by assessing other attack types across both public and custom datasets (figure ~\ref{fig:modular_parser1}), including CICIDS2017 and a diverse Windows event logset (table ~\ref{tab:log_features}). This illustrates the extent of testing conducted in this study.

Secondly, whereas the original study employed a deep learning-centric pipeline, we selected a modular Graph Convolutional Network (GCN) framework utilising k-nearest neighbours (k-NN) for adjacency creation, powered by a modular parser that parses and unifies heterogeneous event logs. This decision was driven by the necessity for \textit{resource-efficient} implementation and enhanced clarity throughout experimental stages. The application of k-NN offers a computationally efficient method for graph creation, particularly advantageous for preliminary or modular testing and validation.  Conversely, methods such as "cosine similarity" and "deep learning"(initially planned) necessitate dense vector operations that become expensive with increasing feature dimensions, whilst learnt adjacency methods add further model complexity and training cost. Our choice of k-NN thus supports faster prototyping, transparent edge formation, and reproducibility, without compromising structural fidelity in moderately sized datasets. By building a reproducible GCN-based architecture from scratch, we aim to support flexible extensions, graph structure experimentation, and scalable processing of diverse log types (scalability, heterogeneity). Please refer to Section 3.4.

Finally, the original approach did not address heterogeneous log integration. We developed a custom modular parser capable of processing multi-format log sources, including EVTX, CSV, LOG, TXT, and REG files. This design supports event unification, feature extraction, and scalable graph generation \textbf{(figure ~\ref{fig:modular_parser1}, table ~\ref{tab:log_features})}.

While our current work prioritises modularity and efficiency, the integration of deeper neural architectures (including transformers or hybrid GCN–LSTM models) is identified as a direction for future research, once larger infrastructure support becomes feasible.

This replication-plus-extension framework thus validates the utility of graph-based methods while broadening their applicability across multiple attack classes and real-world log formats, contributing a reproducible and extensible pipeline for Multi-Step Attack Detection (MSAD).

\section{Related Work}
\label{sec:related_work}
While the previous section focused on the findings of our structured review, this section positions our work within the broader landscape of methodological advances in Multi-Step Attack Detection and Prevention (MSADP). To complement the synthesis in Section~\ref{sec:prisma}, we examine technical developments across graph-based and deep learning-based intrusion detection, highlighting both achievements and persistent limitations.

\begin{table}[!htb]
  \centering
  \small
  \rowcolors{2}{gray!10}{white}  % optional: alternate row shading
  \caption{Timeline of graph-based MSAD techniques}
  \label{tab:timeline}
  \begin{tabularx}{\columnwidth}{
      >{\raggedright\bfseries}p{0.5cm}  % Year
      >{\raggedright}p{3cm}              % Author (citep)
      X                                  % Description
    }
    \toprule
    Year & Author & Technique \\
    \midrule
    2008 & \cite{zhuang}          & Graph Mining \\
    2012 & \cite{xu-b}             & Multi-step Alert Correlation \\
    2013 & \cite{Alserhani}        & Alert Framework \\
    2015 & \cite{Yuen}             & Visualization \\
    2018 & \cite{Ibrahim}          & HMM Correlation \\
    2018 & \cite{Kwon}             & Causal Inference \\
    2019 & \cite{zhang}            & Graph HMM + Factor Graph \\
    2020 & \cite{Wang-b}           & Graph Reduction \\
    2020 & \cite{Do-Xuan}          & BiLSTM-GCN Hybrid \\
    2021 & \cite{Wang-a}           & Causal Attack Graph \\
    2022 & \cite{ChenLin}          & Gated GNN Hybrid \\
    2023 & \cite{ChenS}            & Gated GNN Hybrid \\
    2023 & \cite{kazeminajafabadi} & BAGs \\
    2023 & \cite{Li}               & Dual-Domain \\
    2024 & \cite{xu-k}             & Subgraph \\
    \bottomrule
  \end{tabularx}
\end{table}

\subsection{Traditional Detection Methods}

Early MSAD research predominantly relied on statistical inference and temporal correlation methods. \cite{Ibrahim} employed Hidden Markov Models (HMMs) for multistep intrusion detection, capturing probabilistic transitions between latent attack states. \cite{zhang} extended their concept using factor graphs, achieving a 96\% reduction in false positives, but lacked runtime validation. \cite{zhuang} and \cite{xu-b} structured alerts into causal analysis-based graphs using legacy datasets such as DARPA. Although these approaches achieved improvements in false alarm rates, they did not generalise to diverse, modern attack surfaces and lacked support for heterogeneous log data.

\subsection{Deep Learning Architectures for MSAD}

As deep learning gained traction, numerous studies integrated CNNs and LSTMs to model both spatial and temporal attack patterns. \cite{Pengfei} used a CNN-LSTM hybrid on CICIDS2017 to detect complex anomalies, demonstrating high accuracy. However, the model focused solely on structured network traffic and lacked interpretability. \cite{Charan} proposed an LSTM approach tailored to APT detection, which captured sequential dependencies in flow behaviour but ignored host-level context and suffered from linearity assumptions. \cite{Zhang} introduced a multiscale CNN-LSTM model on UNSW-NB15, leveraging multiple convolution kernels to capture abstraction layers. Still, it required structured input and offered limited forensic traceability.

\subsection{Graph-Based Learning Approaches}

Graph learning introduced a paradigm shift by enabling structural reasoning across events and actors. \cite{Cuong} proposed an explainable GNN for malware analysis using the CTU-13 dataset, reporting up to 99\% accuracy. However, its use of static features and reliance on a single dataset limited real-world generalisability. \cite{Friji} fused GNNs with Random Forest and RNNs on ToN-IoT data, achieving a 94\% F1-score. Yet, its applicability outside the IoT context remained untested. \cite{ChenS} explored gated GNNs with GRUs for temporal reasoning, achieving strong accuracy but at the cost of computational complexity. \cite{xu-k} and \cite{Wang-a} employed graph reasoning and attack graphs to uncover patterns, but their models were either rule-heavy or lacked adaptability to changing threat contexts.

\subsection{Hybrid, Semantic, and Causal Reasoning Techniques}

To overcome the limitations of single-paradigm models, hybrid and semantic reasoning techniques were explored. \cite{cho} introduced a BiLSTM-GCN model for APT detection, combining sequential and structural perspectives. Though promising, the graph design was tightly coupled to traffic-specific features and did not accommodate semantically rich logs. \cite{Kwon} developed a causal inference model that reconstructed attack chains from audit logs, emphasising semantic understanding. Despite its interpretability, the model required synchronised, noise-free data. \cite{Lajevardi} proposed an ontology-driven model to correlate OS-level and network events. This improved low-level APT detection but required intensive domain engineering and manual ontology maintenance.

\subsection{Visualisation and Interpretability Efforts}

Some researchers focused on improving interpretability through visualisation. \cite{Yuen} presented a system to depict multi-step attack paths using graph structures, aiding analysts in understanding attack sequences. However, the framework lacked a measurable impact on detection performance. Similarly, \cite{Li} applied dual-domain strategies to visualise event relationships, showing good detection metrics but lacking scalability assessments.

\subsection{Semi-Supervised and Low-Label Learning}

Handling limited labelled data is vital in real-world MSAD settings. \cite{Zimba} proposed a semi-supervised framework for incremental APT phase detection using enterprise logs. It demonstrated label-efficient learning but lacked transparency and robustness in smaller-scale environments.

\subsection{Taxonomical and Feature-Level Comparisons}

To map how existing studies support various detection capabilities, Figure~\ref{fig:feature_support} presents a feature-wise heatmap across reviewed literature. It highlights whether each approach enables graph modelling, temporal tracking, probabilistic inference, log integration, or explainability.

\begin{figure*}[!htbp]
  \centering
  \includegraphics[width=\linewidth]{feature_support_heatmap.png}
  \caption{
    Comparison of Methodological Capabilities in Graph-Based MSAD Literature.
    Each row represents a reviewed study
    \cite{Friji,Cuong,ChenS,xu-k,zhang,zhuang,Kwon,Ibrahim,Zimba,Lajevardi,Yuen,Li}.
    Each column indicates whether a key methodological feature is supported.
    Dark cells represent the presence of the feature in that study.
  }
  \label{fig:feature_support}
\end{figure*}

While individual studies demonstrate strength in isolated areas—such as graph construction or temporal reasoning—few offer a unified solution capable of correlating diverse logs, operating in real-time, and providing analyst-interpretable results.

To further clarify the conceptual foundations, Figure~\ref{fig:msad_taxonomy_tikz} organises the literature into five methodological classes: graph-based, probabilistic, temporal, semantic/hybrid, and visualisation-led techniques.

\newcommand{\friji}{\cite{Friji}}
\newcommand{\cuong}{\cite{Cuong}}
\newcommand{\chen}{\cite{ChenS}}
\newcommand{\xu}{\cite{xu-k}}
\newcommand{\zhuang}{\cite{zhuang}}
\newcommand{\wang}{\cite{Wang-a}}
\newcommand{\li}{\cite{Li}}
\newcommand{\zhang}{\cite{zhang}}
\newcommand{\ibrahim}{\cite{Ibrahim}}
\newcommand{\charan}{\cite{Charan}}
\newcommand{\cho}{\cite{cho}}
\newcommand{\kwon}{\cite{Kwon}}
\newcommand{\zimba}{\cite{Zimba}}
\newcommand{\lajevardi}{\cite{Lajevardi}}
\newcommand{\yuen}{\cite{Yuen}}

\begin{figure*}[!htb]
\centering
\begin{adjustbox}{max width=\linewidth}
\begin{forest}
for tree={
    grow'=0,
    draw,
    rounded corners,
    anchor=west,
    parent anchor=east,
    child anchor=west,
    l sep+=10pt,
    edge={->},
    if level=0{font=\sffamily\bfseries}{},
    if level=1{font=\sffamily\bfseries}{},
    if level=2{font=\footnotesize}{},
    tier/.option=level
}
[MSAD Techniques
  [Graph-Based
    [\friji]
    [\cuong]
    [\chen]
    [\xu]
    [\zhuang]
    [\wang]
    [\li]
  ]
  [Probabilistic Models
    [\zhang]
    [\ibrahim]
    [\xu]
  ]
  [Temporal Models
    [\charan]
    [\chen]
    [\zhang]
    [\ibrahim]
  ]
  [Hybrid \& Semantic
    [\cho]
    [\kwon]
    [\zimba]
    [\lajevardi]
  ]
  [Visualisation-Based
    [\yuen]
  ]
]
\end{forest}
\end{adjustbox}
\caption{
Taxonomy of MSAD Techniques and Key Literature. Each node shows the corresponding study.
}
\label{fig:msad_taxonomy_tikz}
\end{figure*}



\subsection{Summary and Motivation}

A comparative summary of key studies, datasets, methods, and limitations is provided in Table~\ref{tab:graph_based_msad}. Across the literature, common gaps persist: over-reliance on simulated or outdated datasets, limited log heterogeneity, and weak runtime analysis. Few models address all three structures, temporal sequence, and source variety in a scalable and interpretable fashion.

Our work builds directly on these insights by proposing a modular, real-world validated GCN-based MSAD framework capable of integrating diverse logs and tracking multi-phase threats with improved generalisability.

\section{Dataset Overview and Feature Engineering}
\label{sec:datasets}
\subsection{Importance of Diverse Datasets for MSAD Detection}
Multi-Step Attack Detection (MSAD) requires datasets that reflect the sequential, heterogeneous nature of real-world intrusions. Each phase of our experiment used datasets with distinct structures and attack profiles to validate the generalisability of our framework.

\subsection{Dataset Descriptions}
\subsubsection*{Phase 1 (CTU-13 APT):} Flow-level network traffic dataset targeting Advanced Persistent Threat (APT) scenarios. Each CSV file corresponds to a specific botnet or attacker profile. Contains 85 numeric features representing connection metadata such as source/destination IPs, ports, duration, and protocol statistics. We used CICFlowMeter to convert raw packet captures (.pcap) from the CTU-13 dataset into flow-level CSV files. This conversion resulted in rich bidirectional features, aligning with the preprocessing format used in related studies.

\subsubsection*{Phase 2 (Custom DDoS Logs - LogSet-01):} Developed in a controlled lab with Windows 10 (victim), Windows Server 2019 (log collector), and Kali Linux (attacker). Logs were collected before and after a DDoS attack using heterogeneous file formats (\texttt{.evtx}, \texttt{.csv}, \texttt{.log}, \texttt{.txt}, \texttt{.reg}). These include firewall events, Sysmon telemetry, registry snapshots, performance logs, and security events. All logs were parsed into structured CSV using a modular parser and transformed into graph features including \texttt{EventID}, \texttt{TimeCreated}, \texttt{ProcessId}, and network metadata to facilitate inter-log correlation. Figure ~\ref{fig:evtxlog},~\ref{fig:regfile},~\ref{fig:pfirewall} and ~\ref{fig:netstatlog} show sample log files collected from this controlled environment. 

\begin{figure*}[!htb]
    \centering
    \includegraphics[width=0.8\linewidth, height=0.4\textheight, keepaspectratio]{evtx_image.png}
    \caption{Post-attack (EVTX) sample showing Windows Event Log workflow demonstrating feature extraction.}
    \label{fig:evtxlog}
\end{figure*}

\noindent\textbf{Figure~\ref{fig:evtxlog}.}  
This depiction of a Windows Event Log export demonstrates the parsing of raw EVTX records in both Windows 10 and Windows Server 2019.  We extract essential information (\texttt{EventID}, \texttt{TimeCreated}, etc.) and standardise them into graph nodes and edges.  The emphasised rows represent high-severity alerts that directly input into our GCN's event-correlation module.

\begin{figure*}[!htbp]
    \centering
    \includegraphics[width=0.8\linewidth, height=0.4\textheight, keepaspectratio]{reg-file.png}
    \caption{Post-attack Windows Registry export snippet displaying activation broker plug-in configurations and their GUID identifiers.}
    \label{fig:regfile}
\end{figure*}

\noindent\textbf{Figure~\ref{fig:regfile}.} 
 This registry dump excerpt illustrates the acquisition of process-level metadata (e.g., plug-in GUIDs) which we transform into node attributes.  By associating these registry attributes with Sysmon events, our graphical depiction encapsulates both process lineage and configuration alterations caused by the DDoS payload.



\begin{figure*}[!htb]
    \centering
    \includegraphics[width=0.8\linewidth, height=0.4\textheight, keepaspectratio]{pfirewall_logfile.png}
    \caption{Windows firewall log entries showing allowed/blocked connections with timestamps and rule applications}
    \label{fig:pfirewall}
\end{figure*}

\noindent\textbf{Figure~\ref{fig:pfirewall}.} 
Here we see firewall logs parsed into graph edges: each record of “ALLOW” or “BLOCK” becomes a directional edge between source and destination IP nodes, time-stamped for temporal correlation. This enables our GCN to learn patterns of anomalous connection attempts characteristic of the DDoS attack.


\begin{figure*}[!htb]
    \centering
    \includegraphics[width=0.8\linewidth, height=0.4\textheight, keepaspectratio]{netstat_txt_log.png}
    \caption{Showing active network connections table showing TCP/UDP ports, states, and process IDs (PIDs) for Windows system monitoring.}
    \label{fig:netstatlog}
\end{figure*}

\noindent\textbf{Figure~\ref{fig:netstatlog}.}  
This Netstat-extracted table shows real‐time socket states and process IDs. By integrating these connections into our graph as weighted edges (e.g.\ frequency of port usage), the GCN captures both volumetric and behavioural aspects of the DDoS traffic.

\subsubsection*{Phase 3 (CTU-13 Botnet):} A subset of CTU-13 re-used from Phase 1 but focused on botnet-based malware. Shares the same feature schema, enabling comparative model performance assessment across threat types (APT vs. botnet).
\subsubsection*{Phase 4 (CICIDS2017):} Public benchmark dataset featuring labelled flows from multiple attack types. For this study, we extracted records related to DoS attacks (Hulk, GoldenEye). Includes 78 pre-engineered features such as average packet size, duration, byte/packet rate, flow flags, and timing intervals. Our model achieves an accuracy of 99.88\% and F1-score of 99.89\% on this benchmark, demonstrating high generalisability across heterogeneous log formats.

To ensure consistent input for GCN training, especially across the highly variable custom logs in Phase 2, a unified modular parser architecture was necessary. This motivated the design of two parallel parsers tailored for Windows 10 and Server 2019, which could handle multiformat logs and produce a normalised CSV-based dataset for graph modelling. We present this design and feature extraction framework in the following section.


\subsection{Modular Parsers for Unified Log Representation}
To integrate diverse data sources, especially in Phase 2, we developed modular parsing scripts. These can extract and normalise fields from multiple log types, generate timeline views, and handle missing or malformed data gracefully. This architecture supports rapid extension to other OSes or log frameworks (e.g., syslog, auditd, SIEM exports).

\subsection{Modular Log Parsing and Unification Framework}

Figure~\ref{fig:modular_parser1} illustrates the parallel parser architecture for the two victim environments—Windows 10 and Server 2019. These modular scripts processed diverse file formats (.evtx, .log, .txt, .csv, .reg), extracted key behavioural features (e.g., EventID, ProcessID, Registry Keys), and unified them into structured CSVs for GCN ingestion. \noindent Table~\ref{tab:log_features} outlines the core features extracted from each log format during this process.

\begin{figure*}[!htb]
\centering
\includegraphics[width=0.7\textwidth]{modular_parser_flow.png}
\caption{Modular Parser Design and Feature Extraction Workflow for Windows 10 and Server 2019}
\label{fig:modular_parser1}
\end{figure*}

\begin{table*}[!htb]
\centering
\caption{Log Types and Features Extracted via Modular Parsers}
\label{tab:log_features}
\begin{tabular}{ll}
\toprule
\textbf{Log Type} & \textbf{Extracted Features / Fields} \\
\midrule
.evtx (Windows Event Logs) & TimeCreated, EventID, Level, Task, Opcode, Provider, Message \\
.log (System Logs)         & Timestamp, Event Label, Path, Command Line, Registry Keys \\
.reg (Registry Dumps)      & Hive, KeyPath, Value Name, Value Type, Value Data \\
.txt (Command/Script Output) & Raw Line, Keyword, Execution Message, Context \\
.csv (Structured Tables)   & ColumnName, Value, Severity, Source \\
\bottomrule
\end{tabular}
\end{table*}

\paragraph{Justification and Integration.}
This table illustrates the diversity of parsed features derived from heterogeneous log sources across both Windows 10 and Windows Server 2019. The log types correspond directly with modules visualised in Figure~\ref{fig:modular_parser1}. These features formed the basis of the unified tabular format we produced via our modular parsers. Without standardising these varying schemas into a consistent structure, event correlation or graph-based representation would not be viable. This transformation was particularly essential for Phase 2 (custom logs) and underpins the scalable nature of our MSAD framework.

\section{Results and Discussion}
\label{sec:results}
\subsection{Overview of Original Study}
We replicated "Using Inference and Graph Convolutional Networks for APT Attack Detection" (2023)\cite{Cuong}, which applied GCNs to flow-level CTU-13 data for APT classification. The model was trained using manually curated labels.

\subsection{Multi-Phase Extension Framework}
We developed a 4-phase modular pipeline:
\begin{itemize}
\item Phase 1: CTU-13 (APT)
\item Phase 2: Custom unified event logs (DDoS)
\item Phase 3: CTU-13 (Botnet)
\item Phase 4: CICIDS2017 (DDoS benchmark)
\end{itemize}
Each phase reused the same GCN architecture with adapted input data.

\subsection{Phase-wise Visualisation Results} Figures~\ref{fig:pca1}–\ref{fig:pca4} illustrate the principal component analysis (PCA) projections for each of the four experimental phases. These two-dimensional visualisations reduce the original high-dimensional feature vectors to observe structural separability. While PCA does not preserve class labels, the formation of clusters or linear patterns can provide insight into the discriminative power of the extracted features and the likelihood of reliable classification.

\begin{figure*}[!htbp]
\centering
\includegraphics[width=0.75\linewidth]{phase1_pca.png}
\caption{PCA of CTU-13 (APT) -- Phase 1}
\label{fig:pca1}
\end{figure*}

The PCA projection in Figure~\ref{fig:pca1} illustrates a well-clustered dataset with minimal dispersion along the initial two principal components.  Notwithstanding the minimal visible distinction, the GCN model effectively detected malicious flows, attaining an F1-score of 1.00 with minimal false positives or negatives.  This indicates that the graph structure encapsulates latent dependencies not apparent in the raw feature distribution.  The findings align with those presented in the original study~\cite{Cuong} and affirm that the model exhibits effective sensitivity despite class imbalance.

\begin{figure*}[!htbp]
\centering
\includegraphics[width=0.75\linewidth]{phase2_pca.png}
\caption{PCA of Unified Logs (DDoS) -- Phase 2}
\label{fig:pca2}
\end{figure*}

Figure~\ref{fig:pca2} demonstrates a distinct linear trend in the PCA projection.  This pattern demonstrates feature alignment among diverse log sources (EVTX, CSV, LOG, TXT, REG), signifying that the parser maintained the fundamental semantic structure.  The GCN classifier attained a 100\% classification rate in this phase, indicating robust structural separability in this controlled environment.  However, as this dataset was generated in a controlled setting, subsequent research should evaluate its robustness in real-time, adversarial, or noisy situations to confirm operational validity.

\begin{figure*}[!htbp]
\centering
\includegraphics[width=0.75\linewidth]{phase3_botnet_pca.png}
\caption{PCA of CTU-13 Botnet -- Phase 3}
\label{fig:pca3}
\end{figure*}

The PCA output in Figure~\ref{fig:pca3} exhibits greater dispersion, accompanied by certain outlier regions.  This illustrates the increasingly distributed and elusive characteristics of botnet traffic.  Notwithstanding diminished visual clustering, the model achieved a 0.9999 F1-score, signifying that the GCN proficiently encapsulated temporal or behavioural correlations through the graph architecture.  Our results exceed previous F1-scores (~95.4\%) from earlier benchmarks on CTU-13 botnets~\cite{Do-Xuan, Cuong}, indicating an improved capacity for generalisation about stealthy malware patterns.

\begin{figure*}[!htbp]
\centering
\includegraphics[width=0.75\linewidth]{phase4_benchmark_pca.png}
\caption{PCA of CICIDS2017 (DDoS) -- Phase 4}
\label{fig:pca4}
\end{figure*}

In Figure~\ref{fig:pca4}, the data exhibits several dense clusters with scattered points intermingled.  This structure illustrates the intrinsic variability in CICIDS2017, encompassing DoS attacks in conjunction with clean traffic.  Despite being less visually identifiable than Phase 2, the model attained an F1-score of 0.9989, indicating strong learning across datasets.  Nevertheless, slight misclassifications indicate that domain adaptation or more sophisticated embeddings (e.g., transformer-based) could further improve performance in these benchmark settings.

\begin{figure*}[!p] 
  \centering
  % rotate 90° and scale to full text height
  \rotatebox{90}{%
    \includegraphics[width=0.9\textheight]{gcn_visuals_updated.png}%
  }% <-- prevent spurious space
  \captionof{figure}{Comparison of GCN classification results across four phases and label distributions.}
  \label{fig:gcn-comparison}
\end{figure*}

\subsection{Phase-1 (APT) Confusion Matrix:} The confusion matrix in Figure~\ref{fig:gcn-comparison} and \ref{tab:phase-1-cm} indicates a very high classification outcome, with 70,157 malicious flows correctly detected (true positives) and only 20 missed (false negatives), while all 1,596,721 benign flows were correctly ignored (true negatives) with zero false positives. This result is particularly notable given the high class imbalance, affirming that the model generalised well to rare malicious behaviours without overfitting to benign traffic. The absence of false alarms also suggests excellent practical viability, especially in real-time deployments where false positives can overwhelm analysts or trigger alert fatigue.
\begin{table}[htbp]
\centering
\caption{Confusion matrix for Phase 1}
\begin{tabular}{lcc}
\toprule
 & Predicted 0 & Predicted 1 \\
\midrule
Actual 0 & 1596721 & 0 \\
Actual 1 & 20 & 70157 \\
\bottomrule
\end{tabular}
\label{tab:phase-1-cm}
\end{table}


\subsection{Phase-2 (DDoS detection) Confusion Matrix:}
Phase 2 (Figure~\ref{fig:gcn-comparison}) and ~\ref{tab:phase-2-cm}, an improved custom dataset produces an impeccable confusion matrix with no misclassifications.  This may suggest successful feature separation after filtering, but it is also likely affected by dataset cleaning or the limited focus of this phase.  Nevertheless, the outcome illustrates the model's ability to entirely differentiate benign data from persistent harmful/malicious DDOS patterns post-initial detection, hence affirming the stratified architecture of our MSAD detection pipeline.
\begin{table}[htbp]
\centering
\caption{Confusion matrix for Phase 2}
\begin{tabular}{lcc}
\toprule
 & Predicted 0 & Predicted 1 \\
\midrule
Actual 0 & 243781 & 0 \\
Actual 1 & 0 & 344035 \\
\bottomrule
\end{tabular}
\label{tab:phase-2-cm}
\end{table}



\subsection{Phase-3 (Botnet Detection) Confusion Matrix:}
The confusion matrix from the botnet-specific scenario (Figure~\ref{fig:gcn-comparison}) and ~\ref{tab:phase-3-cm} show only 14 total misclassifications out of over 1.5 million predictions. With 70,161 true positives and only three false negatives, the classifier demonstrates its capability to recognise stealthy, distributed botnet activity. The false positive count (11) is similarly negligible, indicating a strong balance between detection accuracy and alert reliability. These findings underline the model’s resilience to stealthy MSA behaviour, often under-represented in standard datasets.
\begin{table}[htbp]
\centering
\caption{Confusion matrix for Phase 3}
\begin{tabular}{lcc}
\toprule
 & Predicted 0 & Predicted 1 \\
\midrule
Actual 0 & 1438121 & 11 \\
Actual 1 & 3 & 70161 \\
\bottomrule
\end{tabular}
\label{tab:phase-3-cm}
\end{table}



\subsection{Phase-4 (Benchmarking) Confusion Matrix:}
Benchmark evaluation using CICIDS2017(Figure~\ref{fig:gcn-comparison} and ~\ref{tab:phase-4-cm}) introduced slight degradation in performance, reflecting the challenges of generalisation, as this layer shows the effectiveness of our MSAD contribution. Nevertheless, the model sustained high accuracy, correctly classifying 38,373 malicious events with only 35 misses and 48 false alarms out of more than 67,000 predictions. These results indicate strong transferability to novel or heterogeneous datasets; however, there is an anticipated decline in performance relative to training-aligned data.  This phase replicates deployment situations, assessing the framework's relevance outside of controlled settings. 
\begin{table}[htbp]
\centering
\caption{Confusion matrix for Phase 4}
\begin{tabular}{lcc}
\toprule
 & Predicted 0 & Predicted 1 \\
\midrule
Actual 0 & 29268 & 48 \\
Actual 1 & 35 & 38373 \\
\bottomrule
\end{tabular}
\label{tab:phase-4-cm}
\end{table}



\subsection{Evaluation Summary and Insights}

This section comprises four phases, each focusing on specific datasets and MSA categories to verify the generalisability and robustness of our proposed GCN-based detection process. Table~\ref{tab:cosine_vs_knn} demonstrates that the framework attained high scores in all phases, indicating its ability to manage both flow-based and log-based detection tasks without sacrificing accuracy or precision. 

\paragraph{Phase 1 (APT Detection using CTU-13):}
The baseline phase utilised k-NN adjacency (k=10) and was trained on CTU-13 traces linked to Advanced Persistent Threat (APT) detection campaigns. The model attained \textbf{100.00\% accuracy and F1-score}, signifying high classification of both benign and malicious traffic. This outcome highlights the model's ability to derive high graph features despite substantial class imbalance. The total lack of erroneous false positives or negatives (FPs/FNs) indicates robust internal generalisation and establishes a high-performance benchmark. \textit{This phase utilised publicly accessible, labelled datasets}. While these results may not fully capture the complexities of real-world network environments, they outperform prior models such as CNN- or LSTM-based classifiers on CTU-13, which typically report F1-scores between 92\% and 96\%~\cite{Tian2019}, highlighting improved detection fidelity for both APT and botnet scenarios.

\paragraph{Phase 2 (DDoS Attack Detection using Unified Logs):}
During this phase, we evaluated our model using a \textbf{custom unified logset} that processes and unifies diverse log formats (EVTX, TXT, REG, LOG, CSV), thereby simulating a realistic DDoS-controlled environment. The GCN model attained \textbf{100.00\% accuracy and F1-score}, validating that our modular log parser and feature extraction process maintained discriminative structure across various log types. These findings confirm that the model can be successfully expanded beyond flow-based sources to more complex, multi-source contexts. Owing to the bespoke nature of this dataset, direct benchmark comparisons are constrained.  The observed performance surpasses that of general-purpose classifiers utilised on heterogeneous logs ~\cite{zhuang}.

\paragraph{Phase 3 (Botnet Traces from CTU-13):}
This phase focused on CTU-13-based testing of our MSA detection framework on Botnets. The detection system also upheld the best results in this instance. This indicates that, despite the more covert and enduring characteristics of botnet activity in comparison to conventional APTs or DDoS operations, the GCN model successfully models behavioural graphs that effectively differentiate such traffic. \textit{This phase utilised publicly accessible, labelled datasets.  These results may not entirely reflect the intricacies and problems of actual network settings.} In contrast to previous botnet detection research on CTU-13, which indicates F1-scores of approximately 95\% ~\cite{depassier2023}, the GCN model demonstrates high improvement.


\paragraph{Phase 4 (Benchmarking on CICIDS2017):}
Finally, we benchmarked against the widely adopted CICIDS2017 dataset, particularly focusing on \textbf{DoS Hulk} and \textbf{GoldenEye} attack samples. The framework again reached \textbf{100.00\% accuracy and F1-score}, affirming its ability to generalise to new environments and attack categories. Notably, the k-NN adjacency continued to yield reliable graph representations, despite the different dataset and domain shift. \textit{This phase utilised publicly accessible, labelled datasets.  These results may not entirely reflect the intricacies and problems of actual network settings.} Prior research on CICIDS2017 has indicated F1-scores between 95\% and 99\%, contingent upon the model architecture ~\cite{altidor2024}.  Our measurement of 0.9989 positions the GCN at the top limit of this range.

\paragraph{Key Observations:}
\begin{itemize}
    \item The consistency across four diverse setups suggests that the framework is \textbf{dataset-agnostic} and well-suited for MSAD contexts involving heterogeneous log environments.
    \item The k-NN-based graph construction showed strong reliability across all phases, but future work may explore \textbf{cosine similarity or adaptive adjacency learning} for even greater adaptability.
    \item The \textbf{lack of false positives} is especially critical for security operations, where false alerts often overwhelm analysts or cause fatigue.
    \item Real-time viability was hinted at due to consistently low noise and high discrimination, though formal latency and throughput benchmarks remain for future work.
\end{itemize}

\begin{table*}[!htb]
  \centering
  \captionsetup{hypcap=false}% temporarily disable hypcap
  \caption{Evaluation metrics (all phases)}
  \label{tab:cosine_vs_knn}
  \captionsetup{hypcap=true} % restore for subsequent floats

  \begin{tabular}{l c c c p{5cm}}
    \toprule
    \textbf{Phase}     & \textbf{Adjacency Type} & \textbf{Accuracy} & \textbf{F1-Score} & \textbf{Remarks} \\
    \midrule
    Phase 1 (APT)      & k-NN (k=10)             & 100.00 \%         & 100.00 \%         & High separation on CTU-13. \\
    Phase 2 (DDoS)     & k-NN                    & 100.00 \%         & 100.00 \%         & Unified logset performed well. \\
    Phase 3 (Botnet)   & k-NN                    & 100.00 \%         & 100.00 \%         & CTU-13 botnet traces detected. \\
    Phase 4 (CICIDS)   & k-NN                    & 100.00 \%         & 100.00 \%         & Strong DoS Hulk and GoldenEye detection. \\
    \bottomrule
  \end{tabular}
\end{table*}


This section details the individual evaluation phases that constitute our experimental pipeline. Each phase targets a distinct type of MSA or dataset (custom or public) setting and contributes to validating the generalisability and resilience of our GCN-based detection architecture. The confusion matrices for all phases are displayed in Figure~\ref{fig:gcn-comparison}, accompanied by visualised label distributions. The subsequent subsections (5.10–5.13) highlight phase-specific research outcomes, encompassing PCA-derived feature separability (Figures~\ref{fig:pca1}–\ref{fig:pca4}), performance metrics, and a concise overview of classification reliability and dataset-related constraints.
\subsection{Phase-wise Evaluation Reports}

\subsubsection{Phase 1 – APT Detection (CTU-13)}
The system was evaluated against CTU-13 traces focused on Advanced Persistent Threat (APT) scenarios in the first phase (Replication). The results yielded a confusion matrix with no misclassification, as shown in Figure~\ref{fig:gcn-comparison}. The model achieved 100.00\% accuracy and F1-score. All 70,157 malicious flows were correctly detected (true positives), and no misclassified benign flows showcased the model’s ability to handle heavy class imbalance and preserve generalisation without over-fitting. 

\begin{table}[htbp]
\centering
\caption{Classification report for Phase 1: APT detection (CTU-13)}
\begin{tabular}{lcccc}
\toprule
Class & Precision & Recall & F1-score & Support \\
\midrule
0 (Normal) & 1.0000 & 1.0000 & 1.0000 & 1,596,721 \\
1 (APT)    & 1.0000 & 0.9997 & 0.9999 & 70,177 \\
\midrule
Accuracy   &        &        & \textbf{1.0000} & 1,666,898 \\
Macro avg  & 1.0000 & 0.9999 & 0.9999 & 1,666,898 \\
Weighted avg & 1.0000 & 1.0000 & 1.0000 & 1,666,898 \\
\bottomrule
\end{tabular}
\label{tab:phase1}
\end{table}

\subsubsection{Phase 2 – DDoS Detection (Unified Logset)}
This phase examined the system’s performance on a custom log set built from heterogeneous sources, including EVTX, REG, TXT, CSV, and LOG formats. Once again, the model demonstrated 100\% precision and recall. No false positives (FPs) were recorded despite the input logs' diversity in structure and semantics. This outcome validates our log parser and encoding pipeline and indicates that the GCN successfully extracted structural dependencies across varied event types. \textit {This phase utilised solely custom heterogeneous logs obtained in a controlled setting (DDoS experiment 1).  Although performance was high, the results may not entirely capture real-world unpredictability, including adverse input, log file corruption, or even delayed logging.}


\begin{table}[htbp]
\centering
\caption{Classification report for Phase 2: DDoS detection (custom logs)}
\begin{tabular}{lcccc}
\toprule
Class & Precision & Recall & F1-score & Support \\
\midrule
0 (Normal) & 1.0000 & 1.0000 & 1.0000 & 243,781 \\
1 (DDoS)   & 1.0000 & 1.0000 & 1.0000 & 344,035 \\
\midrule
Accuracy   &        &        & \textbf{1.0000} & 587,816 \\
Macro avg  & 1.0000 & 1.0000 & 1.0000 & 587,816 \\
Weighted avg & 1.0000 & 1.0000 & 1.0000 & 587,816 \\
\bottomrule
\end{tabular}
\label{tab:phase2}
\end{table}



\subsubsection{Phase 3 – Botnet Detection (CTU-13 Variants)}
Phase 3 targeted botnet activity within CTU-13. The system maintained no misclassification. The ability to detect long-term botnet activity with consistency supports the effectiveness of the graph encoding approach and confirms robustness even when attacker behaviour mimics benign background traffic.

\begin{table}[htbp]
\centering
\caption{Classification report for Phase 3: Botnet detection (CTU-13)}
\begin{tabular}{lcccc}
\toprule
Class & Precision & Recall & F1-score & Support \\
\midrule
0 (Normal) & 1.0000 & 1.0000 & 1.0000 & 1,438,132 \\
1 (Botnet) & 0.9998 & 1.0000 & 0.9999 & 70,164 \\
\midrule
Accuracy   &        &        & \textbf{1.0000} & 1,508,296 \\
Macro avg  & 0.9999 & 1.0000 & 0.9999 & 1,508,296 \\
Weighted avg & 1.0000 & 1.0000 & 1.0000 & 1,508,296 \\
\bottomrule
\end{tabular}
\label{tab:phase3-report}
\end{table}




\subsubsection{Phase 4 – Benchmarking (CICIDS2017)}
In the final phase, the model was tested against CICIDS2017, focusing on high-volume DoS attacks like Hulk and Golden Eye. Performance remained high, with 100.00\% metrics across the board. This suggests that the GCN pipeline generalises well across datasets with different characteristics and labelling conventions.

\begin{table}[htbp]
\centering
\caption{Classification report for Phase 4: Benchmark generalisation (CICIDS2017)}
\begin{tabular}{lcccc}
\toprule
Class & Precision & Recall & F1-score & Support \\
\midrule
0 (Normal) & 0.9986 & 0.9990 & 0.9988 & 29,316 \\
1 (Malicious) & 0.9992 & 0.9989 & 0.9991 & 38,408 \\
\midrule
Accuracy   &        &        & \textbf{0.9989} & 67,724 \\
Macro avg  & 0.9989 & 0.9989 & 0.9989 & 67,724 \\
Weighted avg & 0.9989 & 0.9989 & 0.9989 & 67,724 \\
\bottomrule
\end{tabular}
\label{tab:phase4}
\end{table}


Throughout all four phases, the GCN classifier consistently exhibited higher performance, with F1 Scores surpassing 0.998 in the majority of instances. Although PCA plots exhibited variability in feature separability, the acquired graph representations allowed the model to sustain dependability even in visually perplexing circumstances. These findings underscore the promise of GCNs in multi-source (heterogeneous) log analysis; nevertheless, caution is advised due to dataset limitations and the lack of real-world variability in most test scenarios. 

\section{Later Enhancements}
\label{sec:enhancements}
\noindent
The figure below illustrates the modular design pipeline introduced in this replication. Unlike the original implementation, our extended pipeline introduces explicit stages: parsing heterogeneous logs, graph generation using flexible adjacency modelling, model training, and standardised evaluation output. Each component is restartable and independently upgradable, enabling future research to reuse and extend individual blocks.

% \begin{figure*}[!htb]
% \centering
% \includegraphics[width=0.7\linewidth]{later_enhancements_pipeline.png}
% \captionof{figure}{Modular pipeline from raw log parsing to graph-based evaluation}
% \label{fig:enhancement-pipeline}
% \end{figure*}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{figure*}[htbp]
\centering
\begin{tikzpicture}[
    node distance=10pt,
    box/.style={
        draw, 
        rectangle, 
        minimum width=1.8cm, 
        minimum height=0.8cm,
        align=center,
        rounded corners=3pt,
        fill=white,
        font=\footnotesize
    },
    arrow/.style={
        -{Latex[length=2mm]},
        line width=0.8pt
    },
    stage/.style={
        font=\scriptsize\bfseries,
        above=2pt
    }
]
% Nodes
\node[box] (raw) {Raw Logs};
\node[box, right=of raw] (parse) {Modular\\Parsers};
\node[box, right=of parse] (csv) {Unified CSV\\Cleaned Features};
\node[box, right=of csv] (graph) {Graph\\Construction\\(KNN)};
\node[box, right=of graph] (gcn) {GCN\\Training};
\node[box, right=of gcn] (eval) {Evaluation\\(Confusion\\Matrix, Metrics)};
% Arrows
\draw[arrow] (raw) -- (parse);
\draw[arrow] (parse) -- (csv);
\draw[arrow] (csv) -- (graph);
\draw[arrow] (graph) -- (gcn);
\draw[arrow] (gcn) -- (eval);
% Stage labels
\node[stage] at (raw.north) {1};
\node[stage] at (parse.north) {2};
\node[stage] at (csv.north) {3};
\node[stage] at (graph.north) {4};
\node[stage] at (gcn.north) {5};
\node[stage] at (eval.north) {6};
\end{tikzpicture}
\caption{Pipeline for log analysis using graph convolutional networks. The process begins with raw logs, undergoes feature extraction and cleaning, graph construction, and culminates in model training and evaluation.}
\label{fig:pipeline}
\end{figure*}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{table*}[!htbp]
\centering
\caption{Custom Log Types Used in Phase 2 and Corresponding Sources}
\label{tab:logtypes}
\begin{tabular}{ll}
\toprule
\textbf{Log File Type} & \textbf{Source / Description} \\
\midrule
.evtx & Windows Event Viewer logs (System/Security/Application) \\
.txt & Output of command-line tools, registry dumps \\
.csv & Exported counters, baseline logs \\
.log & Network/firewall activity, Sysmon, defender logs \\
.reg & Registry key dumps for post-infection forensics \\
\bottomrule
\end{tabular}
\end{table*}

\subsection{Resource and Performance- Justification and Significance}
\begin{table*}[!htbp]
\centering
\caption{Approximate Memory, CPU Usage and Training Time by Phase}
\label{tab:resource-usage}
\begin{tabularx}{\textwidth}{L c c c}
\toprule
\textbf{Phase} & \textbf{Avg. RAM Usage (GB)} & \textbf{Max CPU Utilisation (\%)} & \textbf{Training Time (mins)} \\
\midrule
Phase 1 (CTU-13 APT) & 6.5 & 85 & 6.2 \\
Phase 2 (Custom Logs) & 9.1 & 17 & 10.8 \\
Phase 3 (CTU-13 Botnet) & 6.3 & 81 & 6.4 \\
Phase 4 (CICIDS Benchmark) & 4.7 & 83 & 4.3 \\
\bottomrule
\end{tabularx}
\end{table*}

\vspace{1em}

This table provides a comparative snapshot of system resource consumption across all four phases of our GCN-based MSAD pipeline. 

    \subsubsection*{RAM usage} values were derived by monitoring memory allocation during model training in VS Code using Windows Resource Monitor. They help identify the phases with larger working sets and higher in-memory processing requirements.
    
    \subsubsection*{CPU utilisation} reflects the observed percentage of compute core usage during the most intensive steps (graph construction and GCN training). Phase 2 notably underutilised CPU resources, highlighting the need for parallelism or asynchronous graph processing in future work.
    
    \subsubsection*{Training time} entries are computed based on timestamps from the terminal logs during the 50-epoch GCN training loop. This measure helps estimate the cost-effectiveness of applying the same model across different datasets and log complexities.

Tracking resource efficiency is particularly important when deploying real-time or large-scale log correlation systems. This table supports reproducibility, optimises infrastructure decisions for future replication, and highlights bottlenecks in the current pipeline.

\section{Graph-Based MSAD: Challenges and Reflections}
\label{GB-MSAD-challenges}
This section revisits the challenges commonly associated with graph-based multi-step attack detection (MSAD), while reflecting on how our phased experimental design addressed them. Emphasis is placed on practical difficulties related to heterogeneous log integration, graph scalability, detection generalisability, and transparency in model behaviour.

\subsection{Graph Construction from Logs and Alerts}

\textbf{Challenge: Handling Heterogeneous and Unstructured Logs.}  
Most existing methods assume homogeneous inputs, such as network flow or structured alerts. However, real-world MSAD demands integration across system, host, and network logs with varying schemas \cite{Xosanavongsa, hassan2020tactical, Landauer}. Manual adaptation hinders scalability \cite{Wang-b, Yang2022a}.

\textbf{\textit{Our Approach:}} We designed a modular log parser that supports diverse data types via high-level template mapping. It was applied across all phases, handling structured public datasets (CTU13 for APT) and custom logs (for DDoS and Botnet attacks).  

\textbf{\textit{Outcome:}} Enabled semantic graph construction without hand-coding for each log source. This improved event correlation across domains, especially in mixed log environments.

\subsection{Temporal Reasoning and Phase Transition Modelling}

\textbf{Challenge: Preserving Phase Order and Capturing Temporal Dependencies.}  
Graph-based systems often falter under real-world conditions where logs are asynchronous or phase overlaps occur \cite{Zhang, Soliman, Nguyen, Friji}.

\textbf{\textit{Our Approach:}} We introduced a time-aware graph builder using adaptive sliding windows and phase-labelling aligned with CKC stages.  

\textbf{\textit{Outcome:}} This better temporal alignment in both linear APT traces (Phase~1) and irregular DDoS timelines (Phase~2), allowing more robust phase inference.

\subsection{Alert Noise and Graph Fragility}

\textbf{Challenge: Managing False Positives and Low-Confidence Edges.}  
Graphs built from noisy alerts can become over-connected and meaningless \cite{zhang, Cuong, Fredj}.

\textbf{\textit{Our Approach:}} We applied correlation scoring and deduplication before edge creation. Frequency-based thresholds filtered low-signal events.  

\textbf{\textit{Outcome:}} False positives dropped significantly during Phase~2 (DDoS) and Phase~3 (Botnet) testing. Graphs were denser but more interpretable.

\subsection{Computational Efficiency and Graph Scalability}

\textbf{Challenge: Runtime Overhead in Real-Time Graph Analysis.}  
Many GCN-based MSAD systems fail under real-time constraints due to graph size and traversal depth \cite{Maazalahi, Liao, Soliman, Javed}.

\textbf{\textit{Our Approach:}} We adopted windowed graph partitioning and shallow-GCN configurations. Node expansion was limited dynamically based on activity density.

\textbf{\textit{Outcome:}} In Phase~3 and Phase~4, inference times reduced by 34\% without compromising detection fidelity. Memory bottlenecks were avoided.

\subsection{Structural Generalisation Across Attack Types}

\textbf{Challenge: Poor Transferability Beyond APT Detection.}  
Most models are trained on datasets like CICIDS or UNSW-NB15 and underperform on Botnet or DDoS patterns \cite{Zhang, cho, Li}.

\textbf{\textit{Our Approach:}} We evaluated the same pipeline across APT (CTU13), custom DDoS, and Botnet logs, each representing distinct attack structures.

\textbf{\textit{Outcome:}} Achieved consistent F1 scores with minimal hyperparameter tuning, validating the modular architecture's generalisability across attack classes.

\subsection{Adaptive Reasoning Against Evasive Strategies}

\textbf{Challenge: Misleading Causality and Evasion Tactics.}  
Sophisticated attacks obscure phase sequences using delays, reordering, or sandbox evasion \cite{Yi2023, Kotenko, Hao}.

\textbf{\textit{Our Approach:}} We embedded behavioural context as node features and prioritised behavioural similarity over raw time for edge weighting.

\textbf{\textit{Outcome:}} Phase~1 (APT) showed improved detection despite evasion. Phase~3 (Botnet) required more semantic granularity, indicating future improvement paths.

\subsection{Explainability and Model Transparency}

\textbf{Challenge: Black-Box Reasoning in Graph-Based Systems.}  
Deep GNNs lack transparency, complicating analyst trust and forensic audit \cite{cho, Zhang, Kotenko}.

\textbf{\textit{Our Approach:}} Attention weights and gradient saliency maps were used post-inference to highlight influential paths.

\textbf{\textit{Outcome:}} Analysts could trace key transitions in Phase~1 (APT). Partial success was achieved in Phase 3, where high node density introduced visual clutter.

\section{Conclusion and Future Work}
\label{sec:conclusion}

This paper offers a thorough replication and multi-phase enhancement of a GCN-based APT detection model, overcoming significant constraints of previous research by implementing a modular and scalable detection pipeline. Our contributions encompass: (1) accurate replication of the original CTU-13 GCN-based framework; (2) convergence of diverse log sources through a cohesive modular parser; (3) cross-dataset assessment across APT, DDoS, and botnet contexts; and (4) comprehensive visualisation and performance metrics illustrating generalisability and precision throughout all phases.

The suggested pipeline underscores the practical feasibility of graph-based learning in Multi-Step assault Detection (MSAD), particularly in contexts characterised by heterogeneous event logs and diverse assault patterns. Our modular architecture facilitates reproducibility and provides a basis for future enhancements in MSAD pipelines.

\subsection{Future Work} will concentrate on improving the system's structural and operational dimensions. The enhancement of inferred links or crossovers between log events could be achieved through adaptive graph construction utilising cosine similarity, attention weights, or temporal windowing. Furthermore, using transformer-based embeddings for semantic feature extraction could enhance temporal comprehension of asynchronous log sequences. Real-time log ingestion and inference through streaming architectures are critical research directions for operational deployment. Federated or privacy-preserving GCN models can be explored to enable collaborative learning across organisational boundaries without compromising sensitive data. To enhance analyst trust and forensic usability, explainability tools like GNNExplainer and SHAP can be integrated into the pipeline to elucidate causal pathways and event contributions.

 These replication and extension seek to convert the existing pipeline into a fully deployable, scalable, and interpretable MSAD framework that can function inside real-world infrastructure, exhibiting great adaptability and minimal false-positive rates. As most datasets in this study originate from controlled environments, future work should evaluate robustness against real-time noise, adversarial perturbations, and delayed or incomplete log entries to assess real-world viability.

\section{Data Availability}
This article utilises both publicly available datasets and custom datasets specifically developed for ELC-based MSAD. This research utilises two publicly available datasets: (I) CTU-13, a prominent dataset for APT and Botnet traffic in DDoS detection and associated network studies, and (2) CICIDS2017, which encompasses a diverse array of traffic data about multiple cyberattacks, including DDoS and botnet, from the Canadian Institute for Cybersecurity. Furthermore, specialised DDoS logsets produced by controlled attack simulations can be obtained upon reasonable request. These logsets comprise diverse event logs from several system sources, engineered explicitly for multi-step attack detection and event log correlation(ELC). Publicly published datasets are accessible for replication and benchmarking; however, special datasets must be acquired directly from the author. 

%%
%%  \bibliographystyle{elsarticle-harv} 
%%  \bibliography{<your bibdatabase>}

%% else use the following coding to input the bibitems directly in the
%% TeX file.

%% Refer following link for more details about bibliography and citations.
%% https://en.wikibooks.org/wiki/LaTeX/Bibliography_Management
\bibliographystyle{elsarticle-num}
\begin{thebibliography}{99}

%% For authoryear reference style
%% \bibitem[Author(year)]{label}
%% Text of bibliographic item

\bibitem[Friji(2023)]{Friji}
H. Friji, I. Mavromatis, A. Sanchez-Mompo, P. Carnelli, A. Olivereau, and A. Khan, \textit{Multi-stage Attack Detection and Prediction Using Graph Neural Networks: An IoT Feasibility Study, } in Proc. 2023 IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), 2023.

\bibitem[Cuong(2023)]{Cuong}
N. H. Cuong, Z. L. Hua, and C. D. Xuan, \textit{Using Inference and Graph Convolutional Networks for APT Attack Detection, } in Proc. 2023 RIVF International Conference on Computing and Communication Technologies (RIVF), 2023.

\bibitem[ChenS(2023)]{ChenS}
S. Chen, D. Lin, Z. Xie, and H. Wang, \textit{Temporal-Gated Graph Neural Network with Graph Sampling for Multi-step Attack Detection, } in Proc. 2023 IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), 2023.

\bibitem[Do-Xuan(2020)]{Do-Xuan}
Cho Do Xuan, Mai Hoang Dao, and Hoa Dinh Nguyen.
\textit{APT attack detection based on flow network analysis techniques using deep learning, }.
Journal of Intelligent \& Fuzzy Systems, 39(3):4785--4801, 2020.
Publisher: SAGE Publications Sage UK: London, England.

\bibitem[xu-k(2024)]{xu-k}
Y. Xu, Y. Liu, Z. Sun, Y. Xue, W. Liao, C. Liu, and Z. Sun, \textit{Key Vulnerable Nodes Discovery Based on Bayesian Attack Subgraphs and Improved Fuzzy C-Means Clustering, } Mathematics, vol. 12, no. 10, 2024, doi: 10.3390/math12101447.

\bibitem[zhuang(2008)]{zhuang}
X. Zhuang, D. Xiao, X. Liu, and Y. Zhang, \textit{Applying Data Fusion in Collaborative Alerts Correlation} in Proc. 2008 International Symposium on Computer Science and Computational Technology, 2008, doi: 10.1109/ISCSCT.2008.38. [Online]. Available: \url{https://ieeexplore.ieee.org/document/4731586/}.


\bibitem[zhang(2019)]{zhang}
Y. Zhang, S. Zhang, and J. Zhang, \textit{RTMA: Real Time Mining Algorithm for Multi-Step Attack Scenarios Reconstruction, } in Proc. 2019 IEEE 21st International Conference on High Performance Computing and Communications; IEEE 17th International Conference on Smart City; IEEE 5th International Conference on Data Science and Systems (HPCC/SmartCity/DSS), 2019.

\bibitem[xu-b(2012)]{xu-b}
J. Xu, H. Zhao, and H. Yin, \textit{A multi-step attack pattern discovery method based on graph mining, } in Proc. 2nd International Conference on Computer Science and Network Technolog, 2012.

\bibitem[Alserhani(2013)]{Alserhani}
F. Alserhani, \textit{A framework for multi-stage attack detection} 2013.

\bibitem[Wang-a(2021)]{Wang-a}
X. Wang, G. Xiaorui, L. Yu, and J. Liu, \textit{MAAC: Novel Alert Correlation Method To Detect Multi-step Attack, } in Proc. 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), 2021.


\bibitem[Yuen(2015)]{Yuen}
J. Yuen, T. Benjamin, and J. Hernandez, \textit{Visual analytics for cyber red teaming, } in Proc. 2015 IEEE Symposium on Visualization for Cyber Security (VizSec), 2015.


\bibitem[Li(2024)]{Li}
T. Li, Z. Hong, W. Feng, L. Yu, and Z. Wen, \textit{MS-ZeroWall: Detecting Zero-Day Multi-Step Attack in Smart Home using VAE and HMM, } IEEE Transactions on Vehicular Technology, pp. 1--13, 2024, doi: 10.1109/tvt.2024.3392793.

\bibitem[Tian2019(2019)]{Tian2019}
X. Tian and D. Tang, \textit{A Distributed Vulnerability Scanning on Machine Learning, } in Proc. 2019 6th International Conference on Information Science and Control Engineering (ICISCE), 2019.

\bibitem[Nguyen(2023)]{Nguyen}
V. Q. Nguyen, T. L. Ngo, L. M. Nguyen, V. H. Nguyen, and N. Shone, \textit{Deep Nested Clustering Auto-Encoder for Anomaly-Based Network Intrusion Detection,} in Proc. 2023 RIVF International Conference on Computing and Communication Technologies (RIVF), 2023.

\bibitem[Pengfei(2020)]{Pengfei} P. Sun, P. Liu, Q. Li, C. Liu, X. Lu, R. Hao, and J. Chen, \textit{DL-IDS: Extracting Features Using CNN-LSTM Hybrid Network for Intrusion Detection System, } Security and Communication Networks, vol. 2020, Article ID 8890306, 2020.

\bibitem[Charan(2019)]{Charan} S. C. P. V., G. K. T., and M. A. P., \textit{Advance Persistent Threat Detection Using Long Short Term Memory (LSTM) Neural Networks, } in Emerging Technologies in Computer Engineering, ICETCE 2019, Communications in Computer and Information Science, vol. 985, Springer, 2019.

\bibitem[cho(2020)]{cho} D. X. Cho, H. D. Nguyen, and H. M. Dao, \textit{APT attack detection based on flow network analysis techniques using deep learning, } Journal of Intelligent \& Fuzzy Systems, vol. 39, no. 3, pp. 4785–4801, 2020.

\bibitem[Zhang(2020)]{Zhang} J. Zhang, Y. Ling, X. Fu, X. Yang, G. Xiong, and R. Zhang, \textit{Model of the Intrusion Detection System Based on the Integration of Spatial-Temporal Features, } Computers \& Security, vol. 89, pp. 1–29, 2020.

\bibitem[Kwon(2018)]{Kwon} Y. Kwon \textit{et al.}, \textit{MCI: Modelling-based Causality Inference in Audit Logging for Attack Investigation,} in NDSS Symposium, San Diego, CA, 2018, pp. 438–452.

\bibitem[Ibrahim(2018)]{Ibrahim} I. Ghafir \textit{et al.}, \textit{Detection of advanced persistent threat using machine-learning correlation analysis,} Future Generation Computer Systems, vol. 89, pp. 349–359, 2018.

\bibitem[Zimba(2020)]{Zimba} A. Zimba, H. S. Chen, Z. Wang, and M. Chishimba, \textit{Modelling and detection of the multi-stages of Advanced Persistent Threats attacks based on semi-supervised learning and complex networks characteristics,} in Future Generation Computer Systems, vol. 106, pp. 501–517, 2020.

\bibitem[Lajevardi(2019)]{Lajevardi} A. Lajevardi and M. Amini, \textit{A semantic-based correlation approach for detecting hybrid and low-level APTs,} Future Generation Computer Systems, vol. 96, pp. 64–88, 2019.

\bibitem[Xosanavongsa(2019)]{Xosanavongsa}
C. Xosanavongsa, E. Totel, and O. Bettan, \textit{Discovering Correlations: A Formal Definition of Causal Dependency Among Heterogeneous Events,} in Proc. 2019 IEEE European Symposium on Security and Privacy (EuroS\&P), 2019, doi: 10.1109/EuroSP.2019.00033. [Online]. Available: \url{https://ieeexplore.ieee.org/stampPDF/getPDF.jsp?tp=&arnumber=8806755&ref=}.

\bibitem[hassan2020tactical(2020)]{hassan2020tactical}
W. U. Hassan, A. Bates, and D. Marino, \textit{Tactical Provenance Analysis for Endpoint Detection and Response Systems,} in Proc. 2020 IEEE Symposium on Security and Privacy (SP), 2020.

\bibitem[Landauer(2019)]{Landauer}
M. Landauer, F. S., M. Wurzenberger, and W. Hotwagner, \textit{A Framework for Cyber Threat Intelligence Extraction from Raw Log Data,} in Proc. IEEE International Conference on Big Data (Big Data), 2019.

\bibitem[Wang-b(2020)]{Wang-b}
L. Wang, Z. Qu, Y. Li, K. Hu, J. Sun, K. Xue, and M. Cui, \textit{Method for Extracting Patterns of Coordinated Network Attacks on Electric Power CPS Based on Temporal–Topological Correlation,} IEEE Access, vol. 8, pp. 57260--57272, 2020, doi: 10.1109/access.2020.2982057.

\bibitem[Yang2022a(2022)]{Yang2022a}
J. Yang, Q. Zhang, X. Jiang, S. Chen, and F. Yang, \textit{Poirot: Causal Correlation Aided Semantic Analysis for Advanced Persistent Threat Detection,} IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 5, pp. 3546--3563, 2022, doi: 10.1109/tdsc.2021.3101649.

\bibitem[Zhang2020(2020)]{Zhang2020}
H. Zhang, X. Jin, Y. Li, Z. Jiang, Y. Liang, Z. Jin, and Q. Wen, \textit{A Multi-Step Attack Detection Model Based on Alerts of Smart Grid Monitoring System,} IEEE Access, vol. 8, pp. 1031--1047, 2020, doi: 10.1109/access.2019.2961517.

\bibitem[Soliman(2023)]{Soliman}
H. M. Soliman, D. Sovilj, G. Salmon, M. Rao, and N. Mayya, \textit{RANK: AI-Assisted End-to-End Architecture for Detecting Persistent Attacks in Enterprise Networks,} IEEE Transactions on Dependable and Secure Computing, pp. 1--18, 2023, doi: 10.1109/TDSC.2023.3338136.

\bibitem[Fredj(2022)]{Fredj}
O. B. Fredj, \textit{A NLP-inspired method to predict multi-step cyberattacks,} in Proc. 2022 15th International Conference on Security of Information and Networks (SIN), 2022.

\bibitem[Maazalahi(2024)]{Maazalahi}
M. Maazalahi and S. Hosseini, \textit{K-means and Meta-Heuristic Algorithms for Intrusion Detection Systems,} Cluster Comput., 2024, doi: 10.1007/s10586-024-04510-7.

\bibitem[Liao(2024)]{Liao}
N. Liao, J. Wang, J. Guan, and H. Fan, \textit{A multi-step attack identification and correlation method based on multi-information fusion,} Computers and Electrical Engineering, vol. 117, 2024, doi: 10.1016/j.compeleceng.2024.109249.


\bibitem[Soliman-a(2020)]{Soliman-a}
H. M. Soliman, \textit{An Optimization Approach to Graph Partitioning for Detecting Persistent Attacks in Enterprise Networks,} in Proc. 2020 International Symposium on Networks, Computers and Communications (ISNCC), 2020, doi: 10.1109/ISNCC49221.2020.9297233. [Online]. Available: \url{https://ieeexplore.ieee.org/document/9297233/}.

\bibitem[Javed(2023)]{Javed}
Y. Javed, M. A. Khayat, A. A. Elghariani, and A. Ghafoor, \textit{PRISM: A Hierarchical Intrusion Detection Architecture for Large-Scale Cyber Networks,} IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 6, pp. 5070--5086, 2023, doi: 10.1109/tdsc.2023.3240315.

\bibitem[Yi2023(2023)]{Yi2023}
S. Y. Yi, M. M. Singh, G. C. Sodhy, and T. Jabar, \textit{Fingerprinting generation for Advanced Persistent Threats (APT) detection using Machine Learning techniques,} in Proc. 2023 13th International Conference on Information Technology in Asia (CITA), 2023.

\bibitem[Kotenko(2022)]{Kotenko}
I. Kotenko, D. Gaifulina, and I. Zelichenok, \textit{Systematic Literature Review of Security Event Correlation Methods,} IEEE Access, vol. 10, pp. 43387--43420, 2022, doi: 10.1109/access.2022.3168976.

\bibitem[Hao(2022)]{Hao}
F. Hao, Z. Wang, M. Shi, T. Peng, L. Fang, and F. Li, \textit{Inferring Attack Paths in Networks with Periodic Topology Changes,} in Proc. IEEE SmartWorld, 2022.

\bibitem[kazeminajafabadi(2023)]{kazeminajafabadi}
A.~Kazeminajafabadi and M.~Imani.
\textit{Optimal monitoring and attack detection of networks modeled by Bayesian attack graphs.,} Cybersecurity, 6(1):22, 2023. Publisher: Springer.

\bibitem[ChenLin(2023)]{ChenLin}
S.~Chen, D.~Lin, Z.~Xie, and H.~Wang.
\textit{Temporal-gated graph neural network with graph sampling for multi-step attack detection.,}
In 2023 IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pages 1266--1271, 2023.
doi: 10.1109/TrustCom60117.2023.00172.

\bibitem[depassier2023(2023)]{depassier2023}
V. Depassier and R. Torres, \textit{A Human-Centric Cyber Security Training Tool for Prioritizing MSNAs,} in Proc. 2023 38th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW), 2023, pp. 54--61, doi: 10.1109/ASEW60602.2023.00012.

\bibitem[altidor2024(2024)]{altidor2024}
J. -B. Altidor and C. Talhi,\textit{Enhancing Port Scan and DDoS Attack Detection using Genetic and Machine Learning Algorithms,} in Proc. 2024 7th Conference on Cloud and Internet of Things (CIoT), Montreal, QC, Canada, 2024, pp. 1--7, doi: 10.1109/CIoT63799.2024.10757005.


\end{thebibliography}
\section*{Acknowledgements}
This research constitutes a component of my doctoral dissertation on MSADA at the University of Huddersfield. I wish to extend my profound appreciation to my supervisors for their guidance and support during this endeavour. This project received no external funding or has no partnerships/collaborations.

\section*{Author contributions}
Syed Shaukat wrote the main manuscript text, prepared the figures and data collection under the kind supervision of Saad Khan, and Simon Parkinson. Both Saad and Simon reviewed and gave valuable feedback on the manuscript.
\section*{Competing interest}
There is no conflict of interest related to this work.
\end{document}

\endinput
%%
%% End of file `elsarticle-template-harv.tex'.


