{"paper_id":"4b279dee-46e9-4e51-bba2-9d28dbfd709d","body_text":"A Phased Graph Convolutional Network Framework for Multi-Step Attack Detection: Event-Log Correlation and Heterogeneous Dataset Evaluation | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article A Phased Graph Convolutional Network Framework for Multi-Step Attack Detection: Event-Log Correlation and Heterogeneous Dataset Evaluation Syed Usman Shaukat, Saad Khan, Simon Parkinson This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7340701/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Multi-Step Attack Detection (MSAD) continues to pose a significant issue in cybersecurity owing to the intricacy of attack sequences and the diversity of log sources. This study presents a modular and extendable detection pipeline utilising Graph Convolutional Networks (GCNs) that facilitates multi-phase attack categorisation and integrated log parsing. We initially replicate a contemporary model for Advanced Persistent Threat (APT) detection utilising the CTU-13 dataset, attaining an F1-score of 100%, hence verifying the baseline. We expand the architecture through four phases: accurately detecting Distributed Denial-of-Service (DDoS) attacks with a custom logset at 100% accuracy; generalising to botnet detection on CTU-13—enhancing previous results (F1: 95.4%) to achieve 100% accuracy and F1-score; and creating a modular parser adept at processing various log types, including Sysmon, Event Logs, Firewall Logs, Performance Logs, and Registry Dumps. In Phase 3, the model attains 99.99% accuracy and F1-score in botnet detection. We further improved these methods to improve distinctiveness and illustrate the development of attacks. The concluding benchmark phase attains 99.88% accuracy and 99.89% F1-score, validating generalisability over diverse logs. Our phased detection pipeline provides versatility across datasets and formats (addressing heterogeneity), promoting scalable MSAD with elevated precision and recall, while ensuring repeatability for practical implementation. Physical sciences/Engineering Physical sciences/Mathematics and computing Graph Convolutional Networks (GCN) Multi-Step Attack Detection Event-Log Correlation APT Detection DDoS Detection Botnet Detection Heterogeneous Datasets Full Text Additional Declarations No competing interests reported. Supplementary Files metricssummary.tex phase4benchmarkconfusionmatrix.npy phase3botnetreport.tex phase1report.tex metricssummary.csv phase4benchmarkreport.tex phase2report.tex phase1classificationreport.txt phase2classificationreport.txt phase2confusionmatrix.npy phase1confusionmatrix.npy elsarticletemplateharv.tex phase3botnetclassificationreport.txt phase3botnetconfusionmatrix.npy phase4benchmarkclassificationreport.txt Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {\"props\":{\"pageProps\":{\"initialData\":{\"identity\":\"rs-7340701\",\"acceptedTermsAndConditions\":true,\"allowDirectSubmit\":true,\"archivedVersions\":[],\"articleType\":\"Article\",\"associatedPublications\":[],\"authors\":[{\"id\":512959797,\"identity\":\"5252b829-ce99-4fad-9f12-6b8b19c7c6ea\",\"order_by\":0,\"name\":\"Syed Usman Shaukat\",\"email\":\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABG0lEQVRIie2RMUvEMBTH33HQLq+cY0qFfIULBx6HnP0qPQJxCbpJwcFO6RJ3h/M7dBLcKgfeUpwLWXTpVFdBqGAPVBRyh24O+cEj8Hi/vH8IgMPxTyEfp9dXAuBrAPxq/EZBrP6sELlboVf8zmB3Q6fgN4+vStA4fL4nLRxRICKxKeNa8MNAGXab4ZRdKsl0dCLCJXCWEVFaFSIPoiAzg6JEjwQqHeio7yAMEyDHmT3Y6UuEnYmL0m/CN5XGOqw2ysVWBWrpReiZRVFCv07JhSa4UVa9siVY1Uxm18rwYtVP7j8Iris5mS3Ha6awsT6f5vypbjszL9Z5E7ZnfJ7nFavb9JyOfDG2Btv7vGn4c/uOjxxZ8zocDofjG+8mGlnIfQIPEwAAAABJRU5ErkJggg==\",\"orcid\":\"\",\"institution\":\"University of Huddersfield\",\"correspondingAuthor\":true,\"prefix\":\"\",\"firstName\":\"Syed\",\"middleName\":\"Usman\",\"lastName\":\"Shaukat\",\"suffix\":\"\"},{\"id\":512959798,\"identity\":\"8b26837b-97d6-4072-b35b-1aa6328bf1b0\",\"order_by\":1,\"name\":\"Saad Khan\",\"email\":\"\",\"orcid\":\"\",\"institution\":\"University of Huddersfield\",\"correspondingAuthor\":false,\"prefix\":\"\",\"firstName\":\"Saad\",\"middleName\":\"\",\"lastName\":\"Khan\",\"suffix\":\"\"},{\"id\":512959802,\"identity\":\"6ed71ec4-a1b5-447a-88c8-40eab0a2930e\",\"order_by\":2,\"name\":\"Simon Parkinson\",\"email\":\"\",\"orcid\":\"\",\"institution\":\"University of Huddersfield\",\"correspondingAuthor\":false,\"prefix\":\"\",\"firstName\":\"Simon\",\"middleName\":\"\",\"lastName\":\"Parkinson\",\"suffix\":\"\"}],\"badges\":[],\"createdAt\":\"2025-08-10 19:53:21\",\"currentVersionCode\":1,\"declarations\":\"\",\"doi\":\"10.21203/rs.3.rs-7340701/v1\",\"doiUrl\":\"https://doi.org/10.21203/rs.3.rs-7340701/v1\",\"draftVersion\":[],\"editorialEvents\":[],\"editorialNote\":\"\",\"failedWorkflow\":false,\"files\":[{\"id\":94825110,\"identity\":\"2d807c8b-46c7-4104-99e7-e000c9c7e425\",\"added_by\":\"auto\",\"created_at\":\"2025-10-31 06:49:53\",\"extension\":\"pdf\",\"order_by\":1,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"manuscript-pdf\",\"size\":2426553,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"APhasedGraphConvolutionalNetworkFrameworkforMultiStepAttackDetectionCopy.pdf\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1_covered_07c1ebac-7e97-4c02-8f1a-c0928b646dda.pdf\"},{\"id\":91142196,\"identity\":\"ff932a7e-f916-4a87-a5b2-ecd561cde087\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 05:00:17\",\"extension\":\"tex\",\"order_by\":0,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":986,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"metricssummary.tex\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/1fae435418afef3a285978dc.tex\"},{\"id\":91141623,\"identity\":\"c78b2cd5-7d71-4389-9bbc-2fce0ffb557d\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 04:52:17\",\"extension\":\"npy\",\"order_by\":1,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":160,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"phase4benchmarkconfusionmatrix.npy\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/19addce5c41200c485ffb3bc.npy\"},{\"id\":91142198,\"identity\":\"af1165f1-286f-41c2-accf-2b02b91c1ab6\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 05:00:17\",\"extension\":\"tex\",\"order_by\":2,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":151,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"phase3botnetreport.tex\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/152029a6ff26508c2d4ff593.tex\"},{\"id\":91141626,\"identity\":\"f172c8e9-30ea-4ec7-a631-a221b82ae5d7\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 04:52:17\",\"extension\":\"tex\",\"order_by\":3,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":144,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"phase1report.tex\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/a032d296e4312e28d59135a5.tex\"},{\"id\":91142197,\"identity\":\"e5b0f333-6bee-4c33-9d38-6e5887b1092a\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 05:00:17\",\"extension\":\"csv\",\"order_by\":4,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":302,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"metricssummary.csv\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/a7cb1fd98b004d68ba56882f.csv\"},{\"id\":91142200,\"identity\":\"7da57a45-5b20-480a-8544-3aa806290056\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 05:00:17\",\"extension\":\"tex\",\"order_by\":5,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":154,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"phase4benchmarkreport.tex\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/4b24453d25762fb788c8baa6.tex\"},{\"id\":91141629,\"identity\":\"d84a7c28-8486-4379-9c5d-1de1e2f7b6dd\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 04:52:17\",\"extension\":\"tex\",\"order_by\":6,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":144,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"phase2report.tex\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/98df74073ebbcfde67d82310.tex\"},{\"id\":91141634,\"identity\":\"79731214-2e1c-4e7d-8fef-71cef1c6bac4\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 04:52:17\",\"extension\":\"txt\",\"order_by\":7,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":326,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"phase1classificationreport.txt\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/60596425174a73c91cc13b25.txt\"},{\"id\":91141632,\"identity\":\"ecfef321-8990-4582-97ea-4a026bffcbaf\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 04:52:17\",\"extension\":\"txt\",\"order_by\":8,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":326,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"phase2classificationreport.txt\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/29f3e248ee0f1ff19267ab97.txt\"},{\"id\":91141630,\"identity\":\"ab76cdd4-f0e5-4f38-a1bd-422a0eb3cb61\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 04:52:17\",\"extension\":\"npy\",\"order_by\":9,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":160,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"phase2confusionmatrix.npy\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/92a73e0652eab4b4c7132eac.npy\"},{\"id\":91141638,\"identity\":\"62c2911a-6234-43a2-be5f-44745848c439\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 04:52:17\",\"extension\":\"npy\",\"order_by\":10,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":160,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"phase1confusionmatrix.npy\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/21ebb9d15b33e7a94f4581f0.npy\"},{\"id\":91141633,\"identity\":\"a976c62f-be8b-4206-9a00-4b3f1b4811fe\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 04:52:17\",\"extension\":\"tex\",\"order_by\":11,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":93801,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"elsarticletemplateharv.tex\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/8d433faf3ec0379e3020ec07.tex\"},{\"id\":91141635,\"identity\":\"006d57db-61a1-4730-ae07-441db216b41f\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 04:52:17\",\"extension\":\"txt\",\"order_by\":12,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":326,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"phase3botnetclassificationreport.txt\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/044e84dfd40a7a253e17554b.txt\"},{\"id\":91141637,\"identity\":\"2fd25c78-34c4-4a7f-8d6d-bd09806f4c98\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 04:52:17\",\"extension\":\"npy\",\"order_by\":13,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":160,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"phase3botnetconfusionmatrix.npy\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/015b1e89f300c68be0d0e968.npy\"},{\"id\":91141636,\"identity\":\"cbd25bae-3eab-4421-bc2e-2ea93e2b58d6\",\"added_by\":\"auto\",\"created_at\":\"2025-09-12 04:52:17\",\"extension\":\"txt\",\"order_by\":14,\"title\":\"\",\"display\":\"\",\"copyAsset\":false,\"role\":\"supplement\",\"size\":326,\"visible\":true,\"origin\":\"\",\"legend\":\"\",\"description\":\"\",\"filename\":\"phase4benchmarkclassificationreport.txt\",\"url\":\"https://assets-eu.researchsquare.com/files/rs-7340701/v1/8704c59cb3eebbf6f7023ea6.txt\"}],\"financialInterests\":\"No competing interests reported.\",\"formattedTitle\":\"A Phased Graph Convolutional Network Framework for Multi-Step Attack Detection: Event-Log Correlation and Heterogeneous Dataset Evaluation\",\"fulltext\":[],\"fulltextSource\":\"\",\"fullText\":\"\",\"funders\":[],\"hasAdminPriorityOnWorkflow\":false,\"hasManuscriptDocX\":false,\"hasOptedInToPreprint\":true,\"hasPassedJournalQc\":\"\",\"hasAnyPriority\":false,\"hideJournal\":true,\"highlight\":\"\",\"institution\":\"\",\"isAcceptedByJournal\":false,\"isAuthorSuppliedPdf\":true,\"isDeskRejected\":\"\",\"isHiddenFromSearch\":false,\"isInQc\":false,\"isInWorkflow\":false,\"isPdf\":true,\"isPdfUpToDate\":true,\"isWithdrawnOrRetracted\":false,\"journal\":{\"display\":true,\"email\":\"info@researchsquare.com\",\"identity\":\"researchsquare\",\"isNatureJournal\":false,\"hasQc\":true,\"allowDirectSubmit\":true,\"externalIdentity\":\"\",\"sideBox\":\"\",\"snPcode\":\"\",\"submissionUrl\":\"/submission\",\"title\":\"Research Square\",\"twitterHandle\":\"researchsquare\",\"acdcEnabled\":true,\"dfaEnabled\":false,\"editorialSystem\":\"\",\"reportingPortfolio\":\"\",\"inReviewEnabled\":false,\"inReviewRevisionsEnabled\":true},\"keywords\":\"Graph Convolutional Networks (GCN), Multi-Step Attack Detection, Event-Log Correlation, APT Detection, DDoS Detection, Botnet Detection, Heterogeneous Datasets\",\"lastPublishedDoi\":\"10.21203/rs.3.rs-7340701/v1\",\"lastPublishedDoiUrl\":\"https://doi.org/10.21203/rs.3.rs-7340701/v1\",\"license\":{\"name\":\"CC BY 4.0\",\"url\":\"https://creativecommons.org/licenses/by/4.0/\"},\"manuscriptAbstract\":\"Multi-Step Attack Detection (MSAD) continues to pose a significant issue in cybersecurity owing to the intricacy of attack sequences and the diversity of log sources. This study presents a modular and extendable detection pipeline utilising Graph Convolutional Networks (GCNs) that facilitates multi-phase attack categorisation and integrated log parsing. We initially replicate a contemporary model for Advanced Persistent Threat (APT) detection utilising the CTU-13 dataset, attaining an F1-score of 100\\\\%, hence verifying the baseline. We expand the architecture through four phases: accurately detecting Distributed Denial-of-Service (DDoS) attacks with a custom logset at 100\\\\% accuracy; generalising to botnet detection on CTU-13—enhancing previous results (F1: 95.4\\\\%) to achieve 100\\\\% accuracy and F1-score; and creating a modular parser adept at processing various log types, including Sysmon, Event Logs, Firewall Logs, Performance Logs, and Registry Dumps. In Phase 3, the model attains 99.99\\\\% accuracy and F1-score in botnet detection. We further improved these methods to improve distinctiveness and illustrate the development of attacks. The concluding benchmark phase attains 99.88\\\\% accuracy and 99.89\\\\% F1-score, validating generalisability over diverse logs. Our phased detection pipeline provides versatility across datasets and formats (addressing heterogeneity), promoting scalable MSAD with elevated precision and recall, while ensuring repeatability for practical implementation.\",\"manuscriptTitle\":\"A Phased Graph Convolutional Network Framework for Multi-Step Attack Detection: Event-Log Correlation and Heterogeneous Dataset Evaluation\",\"msid\":\"\",\"msnumber\":\"\",\"nonDraftVersions\":[{\"code\":1,\"date\":\"2025-09-12 04:52:12\",\"doi\":\"10.21203/rs.3.rs-7340701/v1\",\"editorialEvents\":[{\"type\":\"communityComments\",\"content\":0}],\"status\":\"published\",\"journal\":{\"display\":true,\"email\":\"info@researchsquare.com\",\"identity\":\"researchsquare\",\"isNatureJournal\":false,\"hasQc\":true,\"allowDirectSubmit\":true,\"externalIdentity\":\"\",\"sideBox\":\"\",\"snPcode\":\"\",\"submissionUrl\":\"/submission\",\"title\":\"Research Square\",\"twitterHandle\":\"researchsquare\",\"acdcEnabled\":true,\"dfaEnabled\":false,\"editorialSystem\":\"\",\"reportingPortfolio\":\"\",\"inReviewEnabled\":false,\"inReviewRevisionsEnabled\":true}}],\"origin\":\"\",\"ownerIdentity\":\"b4958cec-980f-49bd-a628-fabef0e15b8f\",\"owner\":[],\"postedDate\":\"September 12th, 2025\",\"published\":true,\"recentEditorialEvents\":[],\"rejectedJournal\":[],\"revision\":\"\",\"amendment\":\"\",\"status\":\"posted\",\"subjectAreas\":[{\"id\":54487077,\"name\":\"Physical sciences/Engineering\"},{\"id\":54487078,\"name\":\"Physical sciences/Mathematics and computing\"}],\"tags\":[],\"updatedAt\":\"2025-10-30T12:23:10+00:00\",\"versionOfRecord\":[],\"versionCreatedAt\":\"2025-09-12 04:52:12\",\"video\":\"\",\"vorDoi\":\"\",\"vorDoiUrl\":\"\",\"workflowStages\":[]},\"version\":\"v1\",\"identity\":\"rs-7340701\",\"journalConfig\":\"researchsquare\"},\"__N_SSP\":true},\"page\":\"/article/[identity]/[[...version]]\",\"query\":{\"redirect\":\"/article/rs-7340701\",\"identity\":\"rs-7340701\",\"version\":[\"v1\"]},\"buildId\":\"8U1c8b4HqxoKbykW_rLl7\",\"isFallback\":false,\"isExperimentalCompile\":false,\"dynamicIds\":[84888],\"gssp\":true,\"scriptLoader\":[]}","source_license":"CC-BY-4.0","license_restricted":false}