Abstract:To enhance the effectiveness of the Advanced Persistent Threat (APT) detection process, this research proposes a new approach to build and analyze the behavior profiles of APT attacks in network traffic. To achieve this goal, this study carries out two main objectives, including (i) building the behavior profile of APT IP in network traffic using a new intelligent computation method; (ii) analyzing and evaluating the behavior profile of APT IP based on a deep graph network. Specifically, to build the behavior profile of APT IP, this article describes using a combination of two different data mining methods: Bidirectional Long Short-Term Memory (Bi) and Attention (A). Based on the obtained behavior profile, the Dynamic Graph Convolutional Neural Network (DGCNN) is proposed to extract the characteristics of APT IP and classify them. With the flexible combination of different components in the model, the important information and behavior of APT attacks are demonstrated, not only enhancing the accuracy of detecting attack campaigns but also reducing false predictions. The experimental results in the paper show that the method proposed in this study has brought better results than other approaches on all measurements. In particular, the accuracy of APT attack prediction results (Precision) reached from 84 to 91%, higher than other studies of over 7%. These experimental results have proven that the proposed BiADG model for detecting APT attacks in this study is proper and reasonable. In addition, those experimental results have not only proven the effectiveness and superiority of the proposed method in detecting APT attacks but have also opened up a new approach for other cyber-attack detections such as distributed denial of service, botnets, malware, phishing, etc.

Detect Advanced Persistent Threat In Graph-Level Using Competitive AutoEncoder.

ASA: Adversary Situation Awareness Via Heterogeneous Graph Convolutional Networks.

A Hierarchical Approach for Advanced Persistent Threat Detection with Attention-Based Graph Neural Networks

Advanced Persistent Threat Detection in Smart Grid Clouds Using Spatiotemporal Context-Aware Graph Embedding

Hack Me If You Can: Aggregating AutoEncoders for Countering Persistent Access Threats Within Highly Imbalanced Data

MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning

Accurate Anomaly Detection Leveraging Knowledge-enhanced GAT

Sequence Feature Extraction-Based APT Attack Detection Method with Provenance Graphs

APT-KGL: an Intelligent APT Detection System Based on Threat Knowledge and Heterogeneous Provenance Graph Learning

Detecting Anomalous Network Communication Patterns Using Graph Convolutional Networks

Detecting Unknown Threat Based on Continuous-Time Dynamic Heterogeneous Graph Network

AISLE: Self-supervised Representation Learning for the Investigation of Advanced Persistent Threat

Graph Autoencoder Anomaly Detection for E-commerce Application by Contextual Integrating Contrast With Reconstruction and Complementarity

Adaptive Adversarial Attack on Graph Embedding via GAN

MEGR-APT: A Memory-Efficient APT Hunting System Based on Attack Representation Learning

P3GNN: A Privacy-Preserving Provenance Graph-Based Model for APT Detection in Software Defined Networking

Combating Advanced Persistent Threats: Challenges and Solutions

TBDetector:Transformer-Based Detector for Advanced Persistent Threats with Provenance Graph

ARCADE: Adversarially Regularized Convolutional Autoencoder for Network Anomaly Detection

A novel approach for APT attack detection based on an advanced computing

Adversarial Camouflage for Node Injection Attack on Graphs