{"id":"https://openalex.org/W4414079790","doi":"https://doi.org/10.1109/access.2025.3607497","title":"A Review on Multi-Step Attack Detection","display_name":"A Review on Multi-Step Attack Detection","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4414079790","doi":"https://doi.org/10.1109/access.2025.3607497"},"language":"en","primary_location":{"id":"doi:10.1109/access.2025.3607497","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3607497","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2025.3607497","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5119575964","display_name":"Syed Usman Shaukat","orcid":"https://orcid.org/0009-0000-5674-5499"},"institutions":[{"id":"https://openalex.org/I133837150","display_name":"University of Huddersfield","ror":"https://ror.org/05t1h8f27","country_code":"GB","type":"education","lineage":["https://openalex.org/I133837150"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Syed Usman Shaukat","raw_affiliation_strings":["School of computing and engineering, University of Huddersfield, Huddersfield, U.K","Department of Computer Science, University of Huddersfield, Huddersfield, U.K"],"raw_orcid":"https://orcid.org/0009-0000-5674-5499","affiliations":[{"raw_affiliation_string":"School of computing and engineering, University of Huddersfield, Huddersfield, U.K","institution_ids":["https://openalex.org/I133837150"]},{"raw_affiliation_string":"Department of Computer Science, University of Huddersfield, Huddersfield, U.K","institution_ids":["https://openalex.org/I133837150"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053811883","display_name":"Saad Khan","orcid":"https://orcid.org/0000-0001-8613-8200"},"institutions":[{"id":"https://openalex.org/I133837150","display_name":"University of Huddersfield","ror":"https://ror.org/05t1h8f27","country_code":"GB","type":"education","lineage":["https://openalex.org/I133837150"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Saad Khan","raw_affiliation_strings":["School of computing and engineering, University of Huddersfield, Huddersfield, U.K","Department of Computer Science, University of Huddersfield, Huddersfield, U.K"],"raw_orcid":"https://orcid.org/0000-0001-8613-8200","affiliations":[{"raw_affiliation_string":"School of computing and engineering, University of Huddersfield, Huddersfield, U.K","institution_ids":["https://openalex.org/I133837150"]},{"raw_affiliation_string":"Department of Computer Science, University of Huddersfield, Huddersfield, U.K","institution_ids":["https://openalex.org/I133837150"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5037686924","display_name":"Simon Parkinson","orcid":"https://orcid.org/0000-0002-1747-9914"},"institutions":[{"id":"https://openalex.org/I133837150","display_name":"University of Huddersfield","ror":"https://ror.org/05t1h8f27","country_code":"GB","type":"education","lineage":["https://openalex.org/I133837150"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Simon Parkinson","raw_affiliation_strings":["School of computing and engineering, University of Huddersfield, Huddersfield, U.K","Department of Computer Science, University of Huddersfield, Huddersfield, U.K"],"raw_orcid":"https://orcid.org/0000-0002-1747-9914","affiliations":[{"raw_affiliation_string":"School of computing and engineering, University of Huddersfield, Huddersfield, U.K","institution_ids":["https://openalex.org/I133837150"]},{"raw_affiliation_string":"Department of Computer Science, University of Huddersfield, Huddersfield, U.K","institution_ids":["https://openalex.org/I133837150"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I133837150"],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":4.6057,"has_fulltext":false,"cited_by_count":7,"citation_normalized_percentile":{"value":0.95163674,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":91,"max":99},"biblio":{"volume":"13","issue":null,"first_page":"161779","last_page":"161805"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9962999820709229,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9962999820709229,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9940000176429749,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/evasion","display_name":"Evasion (ethics)","score":0.6087999939918518},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.6003000140190125},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.570900022983551},{"id":"https://openalex.org/keywords/automation","display_name":"Automation","score":0.46369999647140503},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.4544999897480011},{"id":"https://openalex.org/keywords/attack-patterns","display_name":"Attack patterns","score":0.310699999332428}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7609999775886536},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.6432999968528748},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.6087999939918518},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.6003000140190125},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5932000279426575},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.570900022983551},{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.46369999647140503},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.4544999897480011},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3580000102519989},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.310699999332428},{"id":"https://openalex.org/C2780262971","wikidata":"https://www.wikidata.org/wiki/Q44554","display_name":"Law enforcement","level":2,"score":0.2937999963760376},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.273499995470047},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2605000138282776},{"id":"https://openalex.org/C112789634","wikidata":"https://www.wikidata.org/wiki/Q18207010","display_name":"False positives and false negatives","level":3,"score":0.259799987077713}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/access.2025.3607497","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3607497","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:pure.atira.dk:publications/845e1796-d1dd-4184-8421-0cb5f889ad7d","is_oa":true,"landing_page_url":"https://pure.hud.ac.uk/en/publications/845e1796-d1dd-4184-8421-0cb5f889ad7d","pdf_url":null,"source":{"id":"https://openalex.org/S4306402508","display_name":"Huddersfield Research Portal (University of Huddersfield)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I133837150","host_organization_name":"University of Huddersfield","host_organization_lineage":["https://openalex.org/I133837150"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Shaukat, S U, Khan, S & Parkinson, S 2025, 'A Review on Multi-step Attack Detection', IEEE Access, vol. 13, 11153648, pp. 161779-161805. https://doi.org/10.1109/ACCESS.2025.3607497","raw_type":"info:eu-repo/semantics/publishedVersion"},{"id":"pmh:oai:doaj.org/article:073f0c99142f40c9a2701a0c40702a88","is_oa":true,"landing_page_url":"https://doaj.org/article/073f0c99142f40c9a2701a0c40702a88","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 13, Pp 161779-161805 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2025.3607497","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3607497","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":103,"referenced_works":["https://openalex.org/W1931900295","https://openalex.org/W1976138549","https://openalex.org/W2049934050","https://openalex.org/W2079707576","https://openalex.org/W2095679230","https://openalex.org/W2098528528","https://openalex.org/W2147897333","https://openalex.org/W2161225422","https://openalex.org/W2284900416","https://openalex.org/W2467685368","https://openalex.org/W2588942002","https://openalex.org/W2593887030","https://openalex.org/W2792581684","https://openalex.org/W2943918184","https://openalex.org/W2956765062","https://openalex.org/W2968884655","https://openalex.org/W2969821124","https://openalex.org/W2971339553","https://openalex.org/W2979175888","https://openalex.org/W2997677709","https://openalex.org/W3008445684","https://openalex.org/W3010216764","https://openalex.org/W3010844922","https://openalex.org/W3015650867","https://openalex.org/W3027747421","https://openalex.org/W3033430763","https://openalex.org/W3035166524","https://openalex.org/W3043534481","https://openalex.org/W3045754159","https://openalex.org/W3080741239","https://openalex.org/W3104803508","https://openalex.org/W3111734087","https://openalex.org/W3115799183","https://openalex.org/W3116863033","https://openalex.org/W3120438935","https://openalex.org/W3131770407","https://openalex.org/W3158901842","https://openalex.org/W3190895447","https://openalex.org/W3217253123","https://openalex.org/W4206266728","https://openalex.org/W4213312450","https://openalex.org/W4214657431","https://openalex.org/W4225596160","https://openalex.org/W4226119873","https://openalex.org/W4285355258","https://openalex.org/W4285357780","https://openalex.org/W4289538107","https://openalex.org/W4289656018","https://openalex.org/W4310723726","https://openalex.org/W4311923020","https://openalex.org/W4312380046","https://openalex.org/W4312818656","https://openalex.org/W4312968719","https://openalex.org/W4313167217","https://openalex.org/W4313315561","https://openalex.org/W4315629879","https://openalex.org/W4316660108","https://openalex.org/W4321606865","https://openalex.org/W4368283296","https://openalex.org/W4379615866","https://openalex.org/W4385323589","https://openalex.org/W4385655998","https://openalex.org/W4386453671","https://openalex.org/W4387089498","https://openalex.org/W4388016151","https://openalex.org/W4388193659","https://openalex.org/W4388214663","https://openalex.org/W4388642342","https://openalex.org/W4388931440","https://openalex.org/W4388938178","https://openalex.org/W4389230731","https://openalex.org/W4389779304","https://openalex.org/W4390311802","https://openalex.org/W4390659912","https://openalex.org/W4390679729","https://openalex.org/W4391382200","https://openalex.org/W4391828053","https://openalex.org/W4391943034","https://openalex.org/W4392905507","https://openalex.org/W4393078776","https://openalex.org/W4393105403","https://openalex.org/W4393142548","https://openalex.org/W4394628760","https://openalex.org/W4395020987","https://openalex.org/W4395056556","https://openalex.org/W4396594856","https://openalex.org/W4396629463","https://openalex.org/W4396654042","https://openalex.org/W4396720508","https://openalex.org/W4396733298","https://openalex.org/W4399119204","https://openalex.org/W4399119917","https://openalex.org/W4399120257","https://openalex.org/W4399169122","https://openalex.org/W4399283303","https://openalex.org/W4400232534","https://openalex.org/W4400449243","https://openalex.org/W4401071202","https://openalex.org/W4402811975","https://openalex.org/W4404629056","https://openalex.org/W4405755095","https://openalex.org/W4405908321","https://openalex.org/W4406580760"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052"],"abstract_inverted_index":{"Multi-step":[0],"Attacks":[1],"(MSAs)":[2],"pose":[3],"a":[4],"significant":[5,68],"cybersecurity":[6,197],"threat,":[7],"aiming":[8],"at":[9,46],"valuable":[10],"assets":[11],"and":[12,41,51,61,85,95,100,112,117,125,140,153,165,183,192,216,233],"essential":[13],"infrastructure":[14],"across":[15,136,149],"diverse":[16],"sectors.":[17],"This":[18,128,157,179],"study,":[19],"concentrating":[20],"on":[21],"geographic":[22],"patterns":[23],"from":[24],"2022":[25],"to":[26,97,171,195],"2024":[27],"(Figure":[28],"1),":[29],"offers":[30,181],"an":[31],"in-depth":[32],"investigation":[33],"of":[34,83,114,169,241],"methodologies":[35,204],"for":[36,161,206],"multi-step":[37],"attack":[38],"detection,":[39,208],"prevention,":[40],"automation":[42],"(DPA).":[43],"It":[44],"looks":[45],"terms":[47],"such":[48,209,224],"as":[49,210,225],"\u2018multi-stage\u2019":[50],"\u2018composite\u2019":[52],"attacks,":[53,84],"highlighting":[54],"shared":[55],"characteristics,":[56],"including":[57,176],"their":[58,141,154],"complexity,":[59],"persistence,":[60],"evasion":[62],"tactics.":[63],"The":[64,90,107],"document":[65],"highlights":[66],"the":[67,80,110,159,172,239],"obstacles":[69],"contemporary":[70],"detection":[71,88],"systems":[72],"encounter,":[73],"especially":[74],"in":[75],"managing":[76],"high-dimensional":[77,234],"data,":[78],"comprehending":[79],"sequential":[81],"characteristics":[82],"sustaining":[86],"real-time":[87],"efficacy.":[89],"research":[91,138,151],"employs":[92],"comprehensive":[93],"visualisations":[94],"statistics":[96],"demonstrate":[98],"geographical":[99],"industry-specific":[101],"behaviours":[102],"associated":[103],"with":[104],"these":[105],"challenges.":[106],"study":[108],"assesses":[109],"pros":[111],"cons":[113],"machine/deep":[115],"learning":[116,212],"graph-based":[118,214],"approaches":[119,167],"using":[120],"performance":[121],"metrics,":[122],"execution":[123],"time,":[124],"cross-dataset":[126],"analyses.":[127],"review":[129,144,180],"significantly":[130,145],"contributes":[131],"by":[132],"identifying":[133],"prevalent":[134,147],"concerns":[135,148],"multiple":[137,150],"studies":[139,152],"respective":[142,155],"frequencies.This":[143],"identifies":[146],"frequencies.":[156],"underscores":[158],"necessity":[160],"more":[162],"dependable,":[163],"robust,":[164],"scalable":[166],"capable":[168],"adapting":[170],"expanding":[173],"threat":[174,190,207,231],"landscape,":[175],"zero-day":[177],"vulnerabilities.":[178],"scholars":[182],"practitioners":[184],"novel":[185],"insights":[186],"into":[187],"formulating":[188],"multi-layered":[189],"identification":[191],"response":[193],"tactics":[194],"enhance":[196],"frameworks.":[198],"Furthermore,":[199],"it":[200],"examines":[201],"how":[202],"different":[203],"used":[205],"machine":[211],"(ML),":[213],"techniques,":[215],"large":[217],"language":[218],"models":[219],"(LLMs),":[220],"address":[221],"particular":[222],"challenges":[223],"elevated":[226],"false":[227],"positives":[228],"(FPs),":[229],"dynamic":[230],"patterns,":[232],"data":[235],"processing,":[236],"while":[237],"emphasising":[238],"limitations":[240],"existing":[242],"solutions.":[243]},"counts_by_year":[{"year":2026,"cited_by_count":6},{"year":2025,"cited_by_count":1}],"updated_date":"2026-08-06T08:24:18.245995","created_date":"2025-10-10T00:00:00"}