AI Reads the Hidden Rhythm of Cyberattacks to Reconstruct Multi-Stage Intrusions Automatically

When a sophisticated cyberattack unfolds over weeks—slipping from a quiet port scan into a software exploit, then lateral movement across hosts, and finally the slow siphoning of data—security analysts face a daunting task: piecing together the full story from millions of raw system events. A new open-access study published in the journal Cybersecurity introduces MotifTrace, a framework that automates this reconstruction by discovering the natural stages of an attack directly from provenance graphs, without any predefined attack signatures or labeled training data.

Provenance graphs have become the backbone of modern digital forensics. Built from kernel-level audit logs collected by frameworks such as Sysdig, CamFlow, and Linux Audit, these directed graphs model causal interactions among processes, files, and network sockets. Every fork, file read, and network connection becomes an edge carrying a timestamp and an operation type. When an intrusion detection system flags a suspicious event—known in the literature as a Point-of-Interest, or POI—investigators trace backward and forward through the graph to find the entry point and the full blast radius of the intrusion.

The problem is what researchers call dependency explosion. A single alert can expand into a provenance graph with tens of thousands of edges, and existing state-of-the-art tools such as DepComm and DepImpact analyze the entire graph from the alert using uniform criteria. That design has a hidden flaw: attacks behave differently at different stages. During reconnaissance, a process may sequentially probe network sockets; during exfiltration, it may bulk-read files and stream them outward. Uniform scoring also attenuates with causal distance, so early-stage activities like the initial compromise—temporally far from the triggering alert—often fall below detection thresholds and are lost.

The Beihang University-led team behind MotifTrace observed something elegant: each attack stage leaves a characteristic fingerprint in the distribution of temporal motifs—small, time-ordered subgraph patterns among groups of entities. Building on the classic network-science notion of motifs introduced by Milo and colleagues, and their temporal extension by Paranjape and colleagues, the researchers cataloged 24 distinct types of temporal triads: six open types, where one pair of nodes lacks a direct edge, and eighteen closed types, where every pair is connected. A process connecting to two sockets in quick succession produces a triad typical of exploitation; bulk file-to-socket transfers produce a signature of data exfiltration.

Crucially, temporal ordering matters in a way that standard graph compression cannot capture. In an SSH tunnel establishment pattern, the bind event must precede the connect event; reversing the order yields a motif resembling ordinary SSH access. Conventional deduplication, which collapses repeated edges between the same entity pair, discards exactly this sequencing information. MotifTrace preserves it, giving the system a principled vocabulary for distinguishing attacker behavior from benign routine.

The framework operates in two phases. The first, MotifEmbed, learns edge-level representations that encode stage-specific motif structures. A sampling procedure called T-Motif Sampling gathers each edge’s temporal neighborhood with a window sized by edge count rather than fixed time, adapting to wildly varying event rates across hosts. A Hawkes process—a self-exciting point process from statistics—then quantifies how strongly prior triads excite the formation of each new edge, with more recent and structurally similar patterns contributing more, and a softmax attention mechanism learning which of the 24 triad types are most informative. Unsupervised DBSCAN clustering on the resulting 128-dimensional embeddings partitions the graph into behaviorally coherent stages, without needing to know in advance how many stages exist.

The second phase, PathRank, hunts for the critical attack paths within each discovered stage. Its scoring function rests on two empirical observations: terminal nodes of attack events tend to show higher out-degrees than their origins, because a compromised process spawns children, opens files, and makes connections; and genuine attack paths tend to involve infrequent edges, since routine service communications produce repetitive, high-frequency patterns. Starting from entry edges, the algorithm recursively explores causally connected paths, keeps the top-ranked candidates, and then merges paths across stages through shared non-file entities—excluding common files like shared libraries, which would otherwise indiscriminately bridge unrelated activity.

The evaluation is striking. Across six attack campaigns of varying complexity—including a three-stage Log4j exploitation chain, an eight-stage cross-host cryptocurrency mining attack, the ATLAS-M5 campaign, and three cases from the DARPA Transparent Computing program—MotifTrace achieved an average Macro-F1 of 0.88 in multi-stage reconstruction, outperforming state-of-the-art methods by more than 21 percent. On the eight-stage mining campaign, its Macro-F1 of 0.85 was more than double that of DepComm and 1.5 times that of DepImpact, whose recall collapsed to 0.26 because they analyze each alert in isolation. In single-stage tests, MotifTrace traded roughly five percentage points of precision for a 22-point gain in recall—a favorable trade, since missed attack steps leave irrecoverable gaps while extra benign edges can simply be filtered out.

Practicality matters too. The system processed every evaluated campaign within an hour on standard hardware, with the largest trace—about 2.49 million raw audit events condensed into roughly 166,000 graph edges—taking 47 minutes under the current single-threaded implementation. Reviewing paths in descending score order, analysts found that examining just the top 30 percent of ranked paths covered about 82 percent of true attack edges on average. On benign-only DARPA logs, the system fabricated no spurious multi-stage scenarios, with fewer than 0.3 percent of edges receiving elevated scores and none merging into cross-stage chains.

The authors are candid about limitations: fine-grained separation of small stages remains difficult in severely imbalanced cross-host campaigns, mimicry attacks that deliberately reshape causal structure pose an open challenge, and the system depends on the quality of upstream alerts, which it does not validate. Still, by eliminating manual stage annotation and predefined attack knowledge, MotifTrace automates one of the most labor-intensive phases of incident response—transforming raw audit logs into structured, analyst-readable attack summaries. As advanced persistent threats grow longer and more complex, tools that can read the hidden rhythm of an attack may become indispensable to defenders.

Subject of Research: Automated multi-stage cyberattack investigation using temporal motifs and provenance graphs

Article Title: MotifTrace: multi-stage attack investigation via automated stage discovery and path reconstruction on provenance graphs

Article References: MotifTrace: multi-stage attack investigation via automated stage discovery and path reconstruction on provenance graphs. (n.d.). https://doi.org/10.1186/s42400-026-00651-x

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00651-x

Keywords: MotifTrace, provenance graphs, cyberattack investigation, temporal motifs, Hawkes process, system audit logs, multi-stage attacks, attack path reconstruction, digital forensics, intrusion detection, machine learning, cybersecurity