Abstract:APT attacks have the characteristics of low frequency, stealth, and persistence. Achieving attack objectives and preventing trace-back often involve diverse tactics, various tools, and changing processes and patterns. Additionally, the goals of APT attacks are diverse. Apart from service disruptions or network outages, the main goals include remotely penetrating target hosts through the network to steal information, unauthorized encryption, and destructive wiping. Existing methods for characterizing attack features lack sufficient research on the communication methods and data transmission patterns used in attacks. In particular, due to the non-associated addresses, low frequency, fragmentation, and silent requirements of attacks, the features exhibited in a single session are increasingly minimal. Traditional approaches are no longer sufficient to address these challenges that relying solely on single-sample statistical features and "packet-sniffing" windowed traffic grouping detection methods. To tackle these issues, we propose a innovative approach to characterize network attack traffic based on Spatial Pyramid Pooling (SPP) by analyzing the attack communication methods and data transmission patters in the network session traffic of APT attacks with the remote information theft. Specifically, it employs derived feature attributes that integrate mean, total, and concentration characteristics to longitudinally extract multi-level spatiotemporal correlated behavioral features from aggregated multi-session sets. These features are then fused with single-session characteristics, ensuring that each session sample possesses both current traffic features and correlated properties of contextual session traffic. Additionally, this approach meets the requirements of fixed-length input for heterogeneous data in deep learning. Extensive experiments have been conducted to demonstrate that this method enhances the effective detection of APT attacks by deep learning models. Experiments results show that this approach exhibits superior timeliness, precision, and specificity when compared to Principal Component Analysis (PCA) artificial feature engineering methods and other methods based on fixed-length deep learning for raw data.

APIVADS: A Novel Privacy-Preserving Pivot Attack Detection Scheme Based on Statistical Pattern Recognition

Adoption of Deep-Learning Models for Managing Threat in API Calls with Transparency Obligation Practice for Overall Resilience

EPASAD: Ellipsoid decision boundary based Process-Aware Stealthy Attack Detector

Modular deep learning-based network intrusion detection architecture for real-world cyber-attack simulation

A Cyberattack Detection-Isolation Scheme For CAV Under Changing Driving Environment

An anomaly behavior characterization method of network traffic based on Spatial Pyramid Pool (SPP)

A Federated Learning Approach for Multi-stage Threat Analysis in Advanced Persistent Threat Campaigns

A novel approach for APT attack detection based on an advanced computing

P2DAP — Sybil Attacks Detection in Vehicular Ad Hoc Networks

Dynamic Information Flow Tracking for Detection of Advanced Persistent Threats: A Stochastic Game Approach

AI-Driven Anomaly Detection: A New Frontier in Web Application Security

A Reinforcement Learning Approach for Dynamic Information Flow Tracking Games for Detecting Advanced Persistent Threats

RAPID: Robust APT Detection and Investigation Using Context-Aware Deep Learning

APTSHIELD: A Stable, Efficient and Real-time APT Detection System for Linux Hosts

Detecting Sybil Attacks in Vehicular Ad Hoc Networks

Vehicle Driving Pattern Based Sybil Attack Detection

Deep ahead-of-threat virtual patching

DISTDET: A Cost-Effective Distributed Cyber Threat Detection System

<sc>Poirot</sc>: Causal Correlation Aided Semantic Analysis for Advanced Persistent Threat Detection

PI-BODE: Programmable Intraflow-based IoT Botnet Detection system

Accurate and Scalable Detection and Investigation of Cyber Persistence Threats