Abstract:APT attacks have the characteristics of low frequency, stealth, and persistence. Achieving attack objectives and preventing trace-back often involve diverse tactics, various tools, and changing processes and patterns. Additionally, the goals of APT attacks are diverse. Apart from service disruptions or network outages, the main goals include remotely penetrating target hosts through the network to steal information, unauthorized encryption, and destructive wiping. Existing methods for characterizing attack features lack sufficient research on the communication methods and data transmission patterns used in attacks. In particular, due to the non-associated addresses, low frequency, fragmentation, and silent requirements of attacks, the features exhibited in a single session are increasingly minimal. Traditional approaches are no longer sufficient to address these challenges that relying solely on single-sample statistical features and "packet-sniffing" windowed traffic grouping detection methods. To tackle these issues, we propose a innovative approach to characterize network attack traffic based on Spatial Pyramid Pooling (SPP) by analyzing the attack communication methods and data transmission patters in the network session traffic of APT attacks with the remote information theft. Specifically, it employs derived feature attributes that integrate mean, total, and concentration characteristics to longitudinally extract multi-level spatiotemporal correlated behavioral features from aggregated multi-session sets. These features are then fused with single-session characteristics, ensuring that each session sample possesses both current traffic features and correlated properties of contextual session traffic. Additionally, this approach meets the requirements of fixed-length input for heterogeneous data in deep learning. Extensive experiments have been conducted to demonstrate that this method enhances the effective detection of APT attacks by deep learning models. Experiments results show that this approach exhibits superior timeliness, precision, and specificity when compared to Principal Component Analysis (PCA) artificial feature engineering methods and other methods based on fixed-length deep learning for raw data.

APT Encrypted Traffic Detection Method based on Two-Parties and Multi-Session for IoT

APT Traffic Detection Based on Time Transform

Your Smart Home Can't Keep a Secret: Towards Automated Fingerprinting of IoT Traffic with Neural Networks

Automatic Mobile App Identification From Encrypted Traffic With Hybrid Neural Networks

An Encrypted Malicious Traffic Detection System Based on Neural Network

App Trajectory Recognition over Encrypted Internet Traffic Based on Deep Neural Network.

An anomaly behavior characterization method of network traffic based on Spatial Pyramid Pool (SPP)

Adversarial Malicious Encrypted Traffic Detection Based on Refined Session Analysis

A Novel Network Forensic Framework for Advanced Persistent Threat Attack Attribution Through Deep Learning

Automatic IoT device identification: a deep learning based approach using graphic traffic characteristics

Deep Learning for Encrypted Traffic Classification and Unknown Data Detection

A lightweight and efficient IoT intrusion detection method based on feature grouping

An Intelligent Digital Twin Method based on Spatio-Temporal Feature Fusion for IoT Attack Behavior Identification

Active eavesdropping detection: a novel physical layer security in wireless IoT

Intelligent botnet detection in IoT networks using parallel CNN‐LSTM fusion

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

Malicious Encrypted Traffic Identification Based on Four-Tuple Feature and Deep Learning

IP Packet-Level Encrypted Traffic Classification Using Machine Learning with a Light Weight Feature Engineering Method

Graph based Encrypted Malicious Traffic Detection with Hybrid Analysis of Multi-view Features

A Heuristic Statistical Testing Based Approach for Encrypted Network Traffic Identification.