Hierarchical Multi-Modal Threat Intelligence Fusion Without Aligned Data: A Practical Framework for Real-World Security Operations
Sisir Doppalapudi
TL;DR
The paper tackles the real-world problem of fusing non-aligned security data streams from networks, emails, and endpoints without ground-truth cross-modal alignment. It introduces Hierarchical Multi-Modal Threat Intelligence Fusion (HM-TIF), which combines modality-specific encoders, a temporal correlation protocol with $w_{ ext{temp}} = \exp(-\lambda |t_i - t_j|)$, and a hierarchical cross-attention mechanism guided by correlation confidence $w$, all trained with a composite loss $\mathcal{L} = \mathcal{L}_{task} + \lambda_1 \mathcal{L}_{consistency} \cdot w + \lambda_2 \mathcal{L}_{independence} \cdot (1-w)$. The framework maintains robust performance with missing modalities and avoids data leakage, while providing deployment guidance for security teams. Empirically, HM-TIF achieves about 88.7% accuracy with a 32% reduction in false positives and demonstrates generalization across datasets, signaling practical value for SOCs facing heterogeneous, uncoordinated data sources.
Abstract
Multi-modal threat detection faces a fundamental challenge that involves security tools operating in isolation, and this creates streams of network, email, and system data with no natural alignment or correlation. We present Hierarchical Multi-Modal Threat Intelligence Fusion (HM-TIF), a framework explicitly designed for this realistic scenario where naturally aligned multi-modal attack data does not exist. Unlike prior work that assumes or creates artificial alignment, we develop principled methods for correlating independent security data streams while maintaining operational validity. Our architecture employs hierarchical cross-attention with dynamic weighting that adapts to data availability and threat context, coupled with a novel temporal correlation protocol that preserves statistical independence. Evaluation on UNSW-NB15, CSE-CIC-IDS2018, and CICBell-DNS2021 datasets demonstrates that HM-TIF achieves 88.7% accuracy with a critical 32% reduction in false positive rates, even without true multi-modal training data. The framework maintains robustness when modalities are missing, making it immediately deployable in real security operations where data streams frequently have gaps. Our contributions include: (i) the first multi-modal security framework explicitly designed for non-aligned data, (ii) a temporal correlation protocol that avoids common data leakage pitfalls, (iii) empirical validation that multi-modal fusion provides operational benefits even without perfect alignment, and (iv) practical deployment guidelines for security teams facing heterogeneous, uncoordinated data sources. Index Terms: multi-modal learning, threat intelligence, non-aligned data, operational security, cross-attention mechanisms, practical deployment