Abstract:To enhance the effectiveness of the Advanced Persistent Threat (APT) detection process, this research proposes a new approach to build and analyze the behavior profiles of APT attacks in network traffic. To achieve this goal, this study carries out two main objectives, including (i) building the behavior profile of APT IP in network traffic using a new intelligent computation method; (ii) analyzing and evaluating the behavior profile of APT IP based on a deep graph network. Specifically, to build the behavior profile of APT IP, this article describes using a combination of two different data mining methods: Bidirectional Long Short-Term Memory (Bi) and Attention (A). Based on the obtained behavior profile, the Dynamic Graph Convolutional Neural Network (DGCNN) is proposed to extract the characteristics of APT IP and classify them. With the flexible combination of different components in the model, the important information and behavior of APT attacks are demonstrated, not only enhancing the accuracy of detecting attack campaigns but also reducing false predictions. The experimental results in the paper show that the method proposed in this study has brought better results than other approaches on all measurements. In particular, the accuracy of APT attack prediction results (Precision) reached from 84 to 91%, higher than other studies of over 7%. These experimental results have proven that the proposed BiADG model for detecting APT attacks in this study is proper and reasonable. In addition, those experimental results have not only proven the effectiveness and superiority of the proposed method in detecting APT attacks but have also opened up a new approach for other cyber-attack detections such as distributed denial of service, botnets, malware, phishing, etc.

A comprehensive comparison study of ML models for multistage APT detection: focus on data preprocessing and resampling

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

A hybrid ensemble machine learning model for detecting APT attacks based on network behavior anomaly detection

A novel approach for APT attack detection based on an advanced computing

A prospective approach to detect advanced persistent threats: Utilizing hybrid optimization technique

An APT Malware Classification Method Based on Adaboost Feature Selection and LightGBM

Detection and Classification of Advanced Persistent Threats and Attacks Using the Support Vector Machine

Detecting APT attacks using an attack intent-driven and sequence-based learning approach

A Novel Preprocessing Methodology for DNN-Based Intrusion Detection

A model for multi-attack classification to improve intrusion detection performance using deep learning approaches

A novel approach for predicting the spread of APT malware in the network

DeepTaskAPT: Insider APT detection using Task-tree based Deep Learning

Proactive Threat Hunting in Critical Infrastructure Protection through Hybrid Machine Learning Algorithm Application

Intrusion Detection System with Machine Learning and Multiple Datasets

An Effective Comparative Analysis of Data Preprocessing Techniques in Network Intrusion Detection System Using Deep Neural Networks

Strengthening Network Security: Deep Learning Models for Intrusion Detection with Optimized Feature Subset and Effective Imbalance Handling

Multi-datasource machine learning in intrusion detection: Packet flows, system logs and host statistics

A novel approach for APT attack detection based on feature intelligent extraction and representation learning

Comparative study of ML models for IIoT intrusion detection: impact of data preprocessing and balancing

Anomaly based multi-stage attack detection method

Advanced Persistent Threat intelligent profiling technique: A survey