Abstract:APT attacks have the characteristics of low frequency, stealth, and persistence. Achieving attack objectives and preventing trace-back often involve diverse tactics, various tools, and changing processes and patterns. Additionally, the goals of APT attacks are diverse. Apart from service disruptions or network outages, the main goals include remotely penetrating target hosts through the network to steal information, unauthorized encryption, and destructive wiping. Existing methods for characterizing attack features lack sufficient research on the communication methods and data transmission patterns used in attacks. In particular, due to the non-associated addresses, low frequency, fragmentation, and silent requirements of attacks, the features exhibited in a single session are increasingly minimal. Traditional approaches are no longer sufficient to address these challenges that relying solely on single-sample statistical features and "packet-sniffing" windowed traffic grouping detection methods. To tackle these issues, we propose a innovative approach to characterize network attack traffic based on Spatial Pyramid Pooling (SPP) by analyzing the attack communication methods and data transmission patters in the network session traffic of APT attacks with the remote information theft. Specifically, it employs derived feature attributes that integrate mean, total, and concentration characteristics to longitudinally extract multi-level spatiotemporal correlated behavioral features from aggregated multi-session sets. These features are then fused with single-session characteristics, ensuring that each session sample possesses both current traffic features and correlated properties of contextual session traffic. Additionally, this approach meets the requirements of fixed-length input for heterogeneous data in deep learning. Extensive experiments have been conducted to demonstrate that this method enhances the effective detection of APT attacks by deep learning models. Experiments results show that this approach exhibits superior timeliness, precision, and specificity when compared to Principal Component Analysis (PCA) artificial feature engineering methods and other methods based on fixed-length deep learning for raw data.

A Novel Behavior-Based Tracking Attack for User Identification

Where You Are Is Who You Are: User Identification by Matching Statistics

BehavSniffer: Sniff User Behaviors from the Encrypted Traffic by Traffic Burst Graphs

App Trajectory Recognition over Encrypted Internet Traffic Based on Deep Neural Network.

: Towards Fine-Grained Unknown Class Detection Against the Open-Set Attack Spectrum with Variable Legitimate Traffic

User identification in cyber-physical space: a case study on mobile query logs and trajectories.

A Non-Intrusive Cyber Physical Social Sensing Solution to People Behavior Tracking: Mechanism, Prototype, and Field Experiments

Hierarchical Identifier: Application to User Privacy Eavesdropping on Mobile Payment App

ActiveTracker: Uncovering the Trajectory of App Activities over Encrypted Internet Traffic Streams

Research on User Identity Authentication Based on Online Behavior Similarity

Characterizing and Detecting Malicious Accounts in Privacy-Centric Mobile Social Networks: A Case Study

Profiling user activities with minimal traffic traces

Modeling User Network Behavior Based on Network Packet Sketches for Masquerade Detection

Website Detection Using Remote Traffic Analysis

Uncovering the Footprints of Malicious Traffic in Wireless/mobile Networks

Scalable Web Traffic Simulations Based on User Personalization

An anomaly behavior characterization method of network traffic based on Spatial Pyramid Pool (SPP)

Unveiling the Digital Fingerprints: Analysis of Internet attacks based on website fingerprints

IoTBeholder: A Privacy Snooping Attack on User Habitual Behaviors from Smart Home Wi-Fi Traffic.

Positive and Unlabeled Learning for User Behavior Analysis Based on Mobile Internet Traffic Data

An Insider Threat Detection Approach Based on Mouse Dynamics and Deep Learning