用六阶段杀伤链模型检测AI代理的多步攻击序列
ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems
- 基于六阶段杀伤链建模攻击过程，用隐马尔可夫模型分析工具调用序列
- 在五种攻击场景中成功识别传统逐次检测无法发现的恶意链
- 适合关注AI代理安全、系统级威胁检测的研究者与开发者
模型上下文协议（MCP）是一种开源标准，使AI代理能够连接外部工具、数据库和服务。尽管这种连通性赋予代理强大能力，但也引入了现有单次调用防御难以可靠检测的多步攻击。攻击者可将看似无害的工具调用组合成恶意序列，逃避孤立检查。本文提出ChainWatch，一种针对基于MCP的AI代理系统中多步攻击的序列检测框架。ChainWatch采用六阶段杀伤链模型描述攻击演进，并应用隐马尔可夫模型（HMM）对工具调用序列进行分类。当会话在多个阶段表现出可疑进展时触发检测规则。该框架依托一个结构化威胁模型，涵盖直接序列攻击、间接提示注入链及混合多阶段攻击。20维特征提取方案捕获工具交互中的行为信号。我们通过五个来自安全文献的代表性攻击场景验证方法，展示ChainWatch如何发现绕过传统逐次安全机制的攻击链。
原文摘要 · Abstract (English)
The Model Context Protocol (MCP) is an open-source standard that allows AI agents to connect to external tools, databases, and services. While this connectivity enables powerful agent capabilities, it also introduces multi-step attacks that existing per-call defenses cannot reliably detect. Attackers can compose individually benign tool invocations into malicious sequences that evade isolated inspection. This paper presents ChainWatch, a sequential detection framework for identifying multi-step attacks in MCP-based AI agent systems. ChainWatch models attack progression using a six-stage kill chain and applies a Hidden Markov Model (HMM) to classify tool-call sequences. Detection rules are triggered when a session exhibits suspicious progression across multiple stages. The framework is supported by a structured threat model covering direct sequential attacks, indirect prompt injection chains, and hybrid multi-stage attacks. A 20-dimensional feature extraction schema captures behavioral signals from tool interactions. We demonstrate the approach using five representative attack scenarios from the security literature, showing how ChainWatch detects attack chains that evade traditional per-call security mechanisms.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。