# A framework for comprehensible multi-modal detection of cyber threats

arXiv: https://arxiv.org/abs/2111.05764 · HTML: https://mlsanity.com/paper/2111.05764/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 42 references that are in the map.
- First posted on arXiv 10 Nov 2021.

## Builds on (most cited first, 7 of 7)

- [Multimodal Machine Learning: A Survey and Taxonomy](https://mlsanity.com/paper/1705.09406/) (2017)
- [A Multimodal Anomaly Detector for Robot-Assisted Feeding Using an LSTM-based Variational Autoencoder](https://mlsanity.com/paper/1711.00614/) (2017)
- [Multi-Modal Trajectory Prediction of Surrounding Vehicles with Maneuver based LSTMs](https://mlsanity.com/paper/1805.05499/) (2018)
- [LIDAR-Camera Fusion for Road Detection Using Fully Convolutional Neural Networks](https://mlsanity.com/paper/1809.07941/) (2018)
- [A Multi-view Context-aware Approach to Android Malware Detection and Malicious Code Localization](https://mlsanity.com/paper/1704.01759/) (2017)
- [An Empirical Investigation into Deep and Shallow Rule Learning](https://mlsanity.com/paper/2106.10254/) (2021)
- [Decision-forest voting scheme for classification of rare classes in network intrusion detection](https://mlsanity.com/paper/2107.11862/) (2021)

## Abstract (arXiv)

Detection of malicious activities in corporate environments is a very complex task and much effort has been invested into research of its automation. However, vast majority of existing methods operate only in a narrow scope which limits them to capture only fragments of the evidence of malware's presence. Consequently, such approach is not aligned with the way how the cyber threats are studied and described by domain experts. In this work, we discuss these limitations and design a detection framework which combines observed events from different sources of data. Thanks to this, it provides full insight into the attack life cycle and enables detection of threats that require this coupling of observations from different telemetries to identify the full scope of the incident. We demonstrate applicability of the framework on a case study of a real malware infection observed in a corporate network.