Context-Aware Web Attack Detection in Open-Source SIEM Systems via MITRE ATT&CK-Enriched Behavioral Profiling

2026-05-13

AI Summary

This study addresses the limitations of traditional rule-based SIEM systems in detecting multi-step web attacks due to insufficient contextual information about source host behavior. To overcome this, the authors propose Smart-SIEM, an enhanced framework integrated into the Wazuh platform that constructs a novel source IP behavioral context vector by fusing HTTP response status codes, rule-trigger frequencies, and MITRE ATT&CK technique occurrences. A two-stage cascaded model combining LightGBM and XGBoost is designed for attack detection and fine-grained classification, complemented by an adaptive retraining mechanism to mitigate concept drift. Experimental results demonstrate a binary classification F1-score of 0.967 and a six-class attack classification F1-score of 0.914, with perfect (100%) detection of brute-force attacks and 98.3% recall for authentication bypass attempts. When confronted with previously unseen attacks, the system’s F1-score recovers from 0.465 to 0.814 after adaptive retraining.

Abstract

Security Information and Event Management (SIEM) systems aggregate log data from heterogeneous sources to detect coordinated attacks. Traditional rule-based correlation engines struggle to classify multi-step web application attacks because they examine each event without reference to the behavioural history of the originating host. We present Smart-SIEM, an AI module for the open-source Wazuh SIEM platform with two contributions: (1) a per-source-IP behavioural context vector encoding HTTP response-status distributions, peak rule activation counts, and MITRE ATT&CK technique frequencies from the N most recent prior events; (2) a two-stage hybrid cascade combining LightGBM for binary attack detection and XGBoost for six-class attack categorisation. Evaluated on 46,454 purpose-built Wazuh security events, context features improve all tested gradient boosting algorithms from ~0.705 macro F1 to 0.947-0.967 (Stage 1) and 0.876-0.914 (Stage 2), an average gain of +0.254 and +0.324 respectively. The hybrid cascade achieves F1 of 0.967 (binary) and 0.914 (six-class). Wazuh's native rule engine detects 0% of Brute Force and Broken Authentication events; the AI module detects 100% and 98.3% respectively. A self-adaptive retraining mechanism recovers from concept drift: F1 drops from 0.905 to 0.465 when unseen attack types emerge, recovering to 0.814 after retraining on the combined corpus.

Problem

• Web Attack Detection
• SIEM
• Behavioral Context
• MITRE ATT&CK
• Multi-step Attacks

Innovation

• context-aware detection
• MITRE ATT&CK
• behavioral profiling
• hybrid cascade model
• concept drift adaptation