DeepChronos：用神经符号方法检测多步骤攻击
DeepChronos: Temporal Neuro-Symbolic Reasoning for Multi-Step Attack Detection
搞安全检测的朋友可以看看这篇。多数入侵检测是先把告警扔出来再关联，DeepChronos 把攻击阶段规则直接写进检测逻辑，F1 在 DARPA 2000 上高出纯神经基线 11.3%，延迟还在毫秒级，做 NDR 或 SIEM 的团队值得对比评估。
arXiv 论文提出 DeepChronos，一个神经符号网络入侵检测系统，将"先检测、后关联"的传统范式改为通过逻辑演进直接检测。
模型将学习到的流级别证据与显式攻击阶段规则、时间先决条件结合，让攻击历史约束每一步检测决策。在 DARPA 2000 和 AIT-LDS V2 两个数据集上，macro F1 比纯神经基线最高提升 11.
3%，在严格时间约束下消除了因果违规，推理延迟保持在毫秒级。
DeepChronos: Temporal Neuro-Symbolic Reasoning for Multi-Step Attack Detection
Modern cyber threats commonly unfold as multi-step attacks comprising temporally and causally related phases. Current defenses commonly follow a detect first and correlate later paradigm. Intrusion detection systems classify events independently, while downstream systems reconstruct attack progression from the resulting alerts or audit records. In this context, learning-based detectors learn attack-step dependencies implicitly as statistical regularities in the data and cannot guarantee that their predictions follow the real attack progression. Conversely, correlation systems represent attack relationships explicitly, but apply this knowledge only after the underlying attack observations have been detected. We present DEEPCHRONOS, a neuro-symbolic network intrusion detection system that shifts the paradigm from detect first and correlate later to detection through logical progression. DEEPCHRONOS combines learned flow-level evidence with explicit attack-phase rules, temporal prerequisites, and previously inferred phases, allowing the evolving attack history to inform and constrain each detection decision. Evaluations on DARPA 2000 and AIT-LDS V2 show that DEEPCHRONOS improves macro F1 over purely neural baselines by up to 11.3%, eliminates causal violations under strict temporal constraints, and maintains millisecond-scale inference latency. These results demonstrate that integrating explicit attack progression knowledge into detection produces more accurate and temporally coherent multi-step attack predictions.
本条情报归属 AITOP「论文」核心追踪栏目。在跨区域产业观察坐标中，该动态直接关联「AI 开发者工具链、Coding Agent 与工程化实践」研究主线，反映出当前技术演进与商业落地的最新风向。涉及核心实体与技术议题包括：DeepChronos、入侵检测、神经符号、网络安全，读者可通过下方标签进入对应专题页查阅历史脉络与关联对比。
信源核验说明：本文原始线索采编自「arXiv cs.AI」（@Sofia Burkow, Andrea Agiollo, Enkeleda Bardhi, Fernando Kuipers, Kaitai Liang, Georgios Smaragdakis），经 AITOP 多维评分管线结构化提炼。