## 3 Materials and Methods
### Method  
Multi-stage attack attribution presents distinctive challenges due to the sequential and temporal characteristics of IDS alerts. The architecture proposed in this work addresses these challenges through a tailored adaptation of the Transformer model, specifically designed to capture intricate temporal patterns and long-range dependencies within alert sequences. In contrast to the original Transformer, which is geared toward sequence-to-sequence tasks, our model excludes the decoder component and concentrates on extracting temporal features for classification purposes. The attack attribution problem was mathematically formulated as a function \(f:\mathcal{X}\rightarrow\mathcal{Y}\), where the input space \(\mathcal{X}\) consists of triplets \((ip_{v},ip_{a},S)\). Here, \(ip_{v}\) and \(ip_{a}\) denote the victim and attacker IP addresses, respectively, and \(S=\{s_{1},\ldots,s_{n}\}\) is a sequence of \(n\) alerts, with each \(s_{i}\) representing a discrete alert type. The output space \(\mathcal{Y}\) corresponds to the probability distribution over the set of possible attackers \(\mathcal{A}\). This formulation allows for the capturing of both the sequential nature of attacks and the contextual information provided by the involved IPs. To process this input, we propose a model architecture capable of simultaneously capturing local features at the alert level and global dependencies throughout the sequence. The model's capacity to handle sequences of varying lengths and learn context-sensitive representations makes it particularly suitable for attribution in MSNA environments. Discrete entities (IPs and alerts) are mapped to continuous vector representations via embedding layers:  
\[E_{ip}:\mathbb{N}\rightarrow\mathbb{R}^{d_{ip}},\quad E_{alert}:\mathbb{N} \rightarrow\mathbb{R}^{d_{alert}} \tag{1}\]  
where \(d_{ip}\) and \(d_{alert}\) denote the embedding dimensions for IP addresses and alerts, respectively. The resulting embeddings are  
\[\mathbf{v}_{v}=E_{ip}(ip_{v}),\quad\mathbf{v}_{a}=E_{ip}(ip_{a}),\quad\mathbf{ S}=[E_{alert}(s_{1}),\ldots,E_{alert}(s_{n})] \tag{2}\]  
where \(\mathbf{v}_{v},\mathbf{v}_{a}\in\mathbb{R}^{d_{ip}}\) are the victim and attacker IP embeddings and \(\mathbf{S}\in\mathbb{R}^{n\times d_{alert}}\) is the matrix of alert embeddings. To encode temporal information, we add a sinusoidal positional encoding to the alert embeddings:  
\[PE_{(pos,2i)}=\sin\biggl{(}\frac{pos}{10,000^{2i/d_{malet}}}\biggr{)},\quad PE _{(pos,2i+1)}=\cos\biggl{(}\frac{pos}{10,000^{2i/d_{malet}}}\biggr{)} \tag{3}\]  
where \(d_{model}\) is the model (embedding) dimension used in the Transformer encoder and \(pos\) and \(i\) are the position and dimension indices, respectively. The encoded sequence is \(\mathbf{S}^{\prime}=\mathbf{S}+PE\), with \(PE\in\mathbb{R}^{n\times d_{model}}\). The core of the model is a multi-head self-attention mechanism, defined for each head as  
\[\text{Attention}(\mathbf{Q},\mathbf{K},\mathbf{V})=\text{softmax}\Bigg{(}\frac{ \mathbf{Q}\mathbf{K}^{\top}}{\sqrt{d_{k}}}\Bigg{)}\mathbf{V} \tag{4}\]  
where \(\mathbf{Q},\mathbf{K},\mathbf{V}\in\mathbb{R}^{n\times d_{k}}\) are the query, key, and value matrices, obtained via learned linear projections of the input, and \(d_{k}\) is the dimension of each head. The multi-head output is  
\[\text{MultiHead}(\mathbf{X})=\text{Concat}(\text{head}_{1},\dots,\text{ head}_{h})\mathbf{W}^{O} \tag{5}\]  
where \(h\) is the number of attention heads, \(\mathbf{W}^{O}\in\mathbb{R}^{hd_{k}\times d_{model}}\) is a learned output projection matrix, and \(\text{Concat}(\cdot)\) denotes concatenation along the feature dimension. The encoded sequence \(\mathbf{S}^{\prime}\) is processed by the Transformer encoder, yielding a contextual representation \(\mathbf{H}\in\mathbb{R}^{n\times d_{model}}\). To aggregate the sequence, we apply mean pooling:  
\[\mathbf{z}=\frac{1}{n}\sum_{i=1}^{n}\mathbf{h}_{i} \tag{6}\]  
where \(\mathbf{h}_{i}\) is the \(i\)-th row of \(\mathbf{H}\) and \(\mathbf{z}\in\mathbb{R}^{d_{model}}\).