Detecting Multi-Stage Persistent Attacks in Enterprises using RANK-E, an Explainable Decision Tree AI

Attacks on corporate infrastructures are becoming more complex and widespread and are even trying to circumvent the detection tools that exist for ages. A newly developed AI framework called RANK-E can expose the occurrence of multi-stage attacks in the commercial software. Its operation is determined by decision trees, which are explainable and intended to repel such dangers. The provision of decision tree models for the analysis of alert diagrams and event scoring is a major advancement of the original RANK design, as it delivers not only more precise but also easier-to-understand classification. By integrating decision tree models into the process of alert graph and event scoring analysis, this framework not only surpasses the original RANK design but also offers the most dependable categorization and the greatest interpretability. The proposed system main building blocks are the following four: first, alert templating & merging to minimize unnecessary warnings; second, alert graph building to illustrate the connections between the different attack stages; third, alert graph partition to separate out distinct incidents; and lastly, incident scoring using the MITRE ATT&CK code. Thanks to the framework's utilization of decision tree algorithms, which provide detection results that are both visible and easily comprehensible, security analysts can witness the classification and prioritization process for each individual event. The decision tree expansion strengthens the framework's ability to uncover hidden connections across attack sequences and provides better justification for detection outcomes, as per evaluations conducted on benchmark datasets. Defense against sophisticated and persistent threats in a corporate environment may be made more reliable and less analyst-intense through the use of the developed.