Abstract: A method for monitoring a processing system in an intrusion detection system (IDS) or digital forensic system (DFS) is provided. The method includes monitoring a log file associated with the processing system and identifying a plurality of sequences within the log file. The method further includes labeling the plurality of sequences using an interface control document to create a labeled plurality of sequences. The method also includes comparing labeled plurality of sequences with a plurality of known malicious sequences of messages. Further, the method includes using a trained machine learning model to identify hacking steps within the labeled plurality of sequences and determining whether a cyber-attack on the system has occurred.