Individual Device Monitoring Has Structural Blind Spots #

Until now, BASTION has analyzed logs for each device to detect anomalies. A firewall port scan, bot attacks on a web server, AD authentication failures—whenever any device exceeds a threshold, we block it.

However, this approach cannot detect campaigns that combine attacks below the threshold.

To detect this “invisible in isolation, but visible across systems” pattern, we implemented a multi-layer correlation engine in BASTION.

Multi-Layer Defense Architecture #

The infrastructure monitored by BASTION is composed of 5 defensive layers.

Traditionally, these 5 layers were monitored independently. The multi-layer correlation engine tracks all layers horizontally by correlating them with the same IP.

Trace Accumulation and Correlation #

The core of the multi-layer correlation engine is a mechanism to accumulate “traces” of attack source IPs across layers.

Periodic analysis every 15 minutes
  → Extract IPs from logs of each layer
  → Record to trace registry "when, in which layer, what was detected"
  → Auto-detect IPs appearing in multiple layers
  → If threshold exceeded, judge as campaign → Auto-block

Even when individual layers show low severity, as traces accumulate across multiple layers, the correlation score rises and auto-block engages as a campaign.

Actual Campaign Detection #

Shortly after implementing the multi-layer correlation engine, campaign detection engaged on an actual attack.

This IP exhibited the following behavioral patterns.

No single layer would have triggered a high judgment. But because the same IP appeared in 3 layers, the multi-layer correlation engine judged it as a campaign and auto-block engaged.

Why This Matters #

Fundamental Difference from Fail2Ban #

Fail2Ban is an excellent tool, but it can only perform single log file threshold judgment. “Ban if 10 403s appear in nginx-error.log”. This is a judgment confined to one device’s one log.

The multi-layer correlation engine tracks behavioral patterns of the same IP across all device logs. It detects “low-frequency, multi-layer” attack campaigns from log context—something individual devices cannot detect.

Accuracy Improves as Connected Devices Increase #

When a new device’s syslog is connected to BASTION, one “layer” is added to multi-layer correlation. As layers increase, the behavioral pattern of the same IP is observed from more angles, improving campaign detection accuracy.

This is a characteristic absent in traditional monitoring tools (independent analysis per device). With BASTION, as monitored targets increase, the entire system’s defensive capability strengthens.

Safety Design #

Since multi-layer correlation auto-blocks, false positive risk management is critical.

Summary #

We implemented a multi-layer correlation engine in BASTION to automatically detect attack campaigns across all system logs. Even attacks below individual device thresholds are judged as campaigns if the same IP appears across multiple defensive layers, triggering auto-block.

Immediately after implementation, cross-layer campaign detection engaged on an actual attack across 3 layers, completing proof of concept. BASTION is evolving from “individual device monitoring tool” to “cross-system attack campaign detection engine”.