Abstract
One of the most common and important destructive attacks on the victim system is Advanced Persistent Threat (APT)-attack. The APT attacker can achieve his hostile goals by obtaining information and gaining financial benefits regarding the infrastructure of a network. One of the solutions to detect a secret APT attack is using network traffic. Due to the nature of the APT attack in terms of being on the network for a long time and the fact that the network may crash because of high traffic, it is difficult to detect this type of attack. Hence, in this study, machine learning methods such as C5.0 decision tree, Bayesian network and deep neural network are used for timely detection and classification of APT-attacks on the NSL-KDD dataset. Moreover, 10-fold cross validation method is used to experiment these models. As a result, the accuracy (ACC) of the C5.0 decision tree, Bayesian network and 6-layer deep learning models is obtained as 95.64%, 88.37% and 98.85%, respectively, and also, in terms of the important criterion of the false positive rate (FPR), the FPR value for the C5.0 decision tree, Bayesian network and 6-layer deep learning models is obtained as 2.56, 10.47 and 1.13, respectively. Other criterions such as sensitivity, specificity, accuracy, false negative rate and F-measure are also investigated for the models, and the experimental results show that the deep learning model with automatic multi-layered extraction of features has the best performance for timely detection of an APT-attack comparing to other classification models.
Highlights
Providing information security is one of the main problems of the companies and organizations, and they constantly try to ensure that their data and information are not compromised due to the accidents and attacks [1]
In terms of the critical criterion of the false positive rate (FPR), the FPR value for the C5.0 decision tree, Bayesian network, and 6-layer deep learning models is obtained as 2.56, 10.47, and 1.13, respectively. Other criterions such as sensitivity, specificity, accuracy, false-negative rate, and F-measure are investigated for the models, and the experimental results show that the deep learning model with automatic multi-layered extraction of features has the best performance for timely detection of an advanced persistent threat (APT)-attack comparing to other classification models
To evaluate the models in the output, criteria such as accuracy, precision, false positive rate (FPR), false negative rate (FNR), sensitivity, specificity and F-measure have been extracted as experiment results
Summary
Providing information security is one of the main problems of the companies and organizations, and they constantly try to ensure that their data and information are not compromised due to the accidents and attacks [1]. The attacks and activities of the attackers have become more complicated and targeted owing to the progress and growth of the cyberspace. Information technology security leaders in companies agree to a 72% budget increase in 2020 to take steps such as continuous staff training, awareness and skill enhancement and reduce the damage caused by intrusion into their systems. Most of the attacks that threaten companies are targeted and long time, some of which are known as Advanced Persistent Threats (APT) [2]. The term APT was first introduced in 2006 by US Army Air Force specialists regarding unknown intrusion activities [3]. APT attacks are carried out by a group of well-funded attackers with a predetermined plan to gain access to the confidential
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
