Context-Aware Web Attack Detection in Open-Source SIEM Systems via MITRE ATT&CK-Enriched Behavioral Profiling

Researchers built Smart-SIEM, an AI add-on for Wazuh that models per-source behavior from recent events and classifies attacks in two stages.

On 46,454 events, the approach delivered much higher F1 scores than baseline models and found attack types the native rule engine missed.

It used behavioral profiling plus MITRE ATT&CK signals to improve detection of multi-step web attacks such as brute force and broken authentication.

The system also recovered performance after retraining under concept drift, showing it can adapt to changing attack patterns.