Combination of DNS traffic analysis: A design to enhance APT detection

Abstract

An activity of Advanced Persistent Threat (APT) is very dynamic. A single detection method will be ineffective. New modus and techniques are being developed rapidly and overcome the effort to acknowledge it. This design proposed a new approach through a combination of previous successful detection method based on DNS traffic analysis altogether, to address today's APT challenges. A preliminary experiment shows promising and better accuracy of APT recognition and faster response.