Text this: Multi-step attack detection method based on network communication anomaly recognition