To address the problems of multi-source heterogeneous alerts, inconsistent alert descriptions, and difficulties in identifying causal relationships between alerts in complex multi-step attack detection, this study proposes a detection method that combines pre-trained models with causal mining. First, a BERT model optimized with SimCSE is used to extract semantic vectors from alert texts and compute their similarity. This achieves unified alert representation and reduces alert redundancy. Second, an initial causal graph is constructed based on association rules, including temporal proximity, address correlation, and severity escalation. A time-aware graph attention network is then combined with the NOTEARS causal structure learning method to refine causal relationships among alert nodes. This eliminates false correlation edges and identifies complete complex multi-step attacks. Experimental results show that the proposed method effectively improves the detection accuracy of complex multi-step attacks.