DCASI: A Sequence-based Attack Investigation Method Using DTW Contrastive Learning

Abstract

The stealth and persistence of APT attacks make investigation particularly challenging, further complicated by the diversity and volume of host logs. Existing methods, though effective, have limitations: 1) They rely heavily on manual processing and complex models that often fail to capture temporal relationships in logs; 2) These models struggle to differentiate highly similar attack behaviors from normal activities; 3) Interpretability and security challenges in deep learning models remain unresolved. This paper introduces DCASI, a sequence-based investigation method that integrates DTW similarity with contrastive learning. By constructing provenance graphs and extracting sequences through node pairs, DCASI performs semantic analysis, computes DTW similarity matrices, and employs contrastive learning to generate robust sequence representations. A lightweight random forest model is then used to identify attack behaviors. Evaluation on public datasets shows that DCASI outperforms existing methods.