Advanced Persistent Threat Detection Research Articles

Bon-APT: Detection, attribution, and explainability of APT malware using temporal segmentation of API calls

Advanced Persistent Threats (APTs) are highly sophisticated cyberattacks that are aimed at achieving strategic goals and are usually backed by a well-funded entity. In this paper, we tackle the challenges of detecting and attributing APTs by proposing Bon-APT, a temporal learning method that analyzes and segment the occurrences of API calls invoked during the dynamic analysis of the examined PE. Those segments can be used to profile the temporal behavior of an APT, provide insights into its modus operandi, and induce an accurate machine-learning based model for the detection and attribution of APTs. Moreover, Bon-APT provides a human comprehensible explainability regarding the relations among segments as well as the behavior of the APT in each of them. This not only improves transparency and reliability from a human expert perspective, but it can also enrich the security experts with new knowledge regarding APTs' behavior. To evaluate Bon-APT, we built a unique collection of 12,655 APTs, belonging to 188 different cyber-groups and 17 different nations, which, to the best of our knowledge, is the largest collection of its kind. We conducted four experiments to evaluate the proposed method and compared its performance to the performance of state-of-the-art methods on the tasks of APT detection and authorship attribution (for both group and nation). Bon-APT achieved promising results in each of the tasks while outperforming the state-of-the-art methods. Bon-APT also provides a simple and concise explanation regarding its decisions and the APT behavior, as well as an easy, straightforward visual and quantitative behavioral comparison.

Detection of advanced persistent threats using hashing and graph-based learning on streaming data

Detection of advanced persistent threats using hashing and graph-based learning on streaming data

ConGraph: Advanced Persistent Threat Detection Method Based on Provenance Graph Combined with Process Context in Cyber-Physical System Environment

With the wide use of Cyber-Physical Systems (CPS) in many applications, targets of advanced persistent threats (APTs) have been extended to the IoT and industrial control systems. Provenance graph analysis based on system audit logs has become a promising way for APT detection and investigation. However, we cannot afford to ignore that existing provenance-based APT detection systems lack the process–context information at system runtime, which seriously limits detection performance. In this paper, we proposed ConGraph, an approach for detecting APT attacks using provenance graphs combined with process context; we presented a module for collecting process context to detect APT attacks. This module collects file access behavior, network access behavior, and interactive relationship features of processes to enrich semantic information of the provenance graph. It was the first time that the provenance graph was combined with multiple process–context information to improve the detection performance of APT attacks. ConGraph extracts process activity features from the provenance graphs and submits the features to a CNN-BiLSTM model to detect underlying APT activities. Compared to some state-of-the-art models, our model raised the average precision rate, recall rate, and F-1 score by 13.12%, 25.61%, and 24.28%, respectively.

Cyber Guardian : Intelligent Threat Surveillance

Advanced persistent threats (APTs) are cyberattacking that use covert strategies to target specific groups. As a result of the rapid growth of computing technology and the widespread connectivity of devices, there has been a boom in data transfer across networks. Because APTs' attack tactics are always changing, it can be difficult to detect them. This has led cybersecurity experts to develop creative solutions. We found gaps in the research on APT detection by doing a systematic literature review (SLR) covering the years 2012 to 2022 and finding 75 studies related to computer, mobile, and Internet of Things technologies. The most sophisticated cyberattack, known as an advanced persistent threat, involves malevolent individuals breaking into a network without authorization and staying hidden for an extended period. Advancement persistent threat attacks and organizational threats are becoming more frequent. Machine learning is one technique used to detect attacks by sophisticated persistent threats. The need for improved detection methods is highlighted by our findings, and we offer suggestions to guide the creation of early APT detection models and progress in cybersecurity. We propose a conceptual model known as Cyber Guardian that uses Random Forest classifier and attention techniques to create a self-translation machine through an encoder-decoder framework. These advanced attention algorithms are intended to improve the machine's capacity to examine and decipher intricate patterns found in HTTP requests, enhancing APT detection capabilities, and providing cybersecurity experts with cutting-edge instruments to proactively detect and neutralize new threats in real-time. This all-encompassing strategy is a major advancement in the ongoing fight against Advanced Persistent Threats (APTs) and emphasizes how crucial it is for the cybersecurity community to continuously innovate and collaborate in order to remain ahead of changing cyberthreats.

APT-KGL: An Intelligent APT Detection System Based on Threat Knowledge and Heterogeneous Provenance Graph Learning

APTs (Advanced Persistent Threats) have caused serious security threats worldwide. Most existing APT detection systems are implemented based on sophisticated forensic analysis rules. However, the design of these rules requires in-depth domain knowledge and the rules lack generalization ability. On the other hand, deep learning technique could automatically create detection model from training samples with little domain knowledge. However, due to the persistence, stealth, and diversity of APT attacks, deep learning technique suffers from a series of problems including difficulties of capturing contextual information, low scalability, dynamic evolving of training samples, and scarcity of training samples. Aiming at these problems, this paper proposes APT-KGL, an intelligent APT detection system based on provenance data and graph neural networks. First, APT-KGL models the system entities and their contextual information in the provenance data by a HPG (Heterogeneous Provenance Graph), and learns a semantic vector representation for each system entity in the HPG in an offline way. Then, APT-KGL performs online APT detection by sampling a small local graph from the HPG and classifying the key system entities as malicious or benign. In addition, to conquer the difficulty of collecting training samples of APT attacks, APT-KGL creates virtual APT training samples from open threat knowledge in a semi-automatic way. We conducted a series of experiments on two provenance datasets with simulated APT attacks. The experiment results show that APT-KGL outperforms other current deep learning based models, and has competitive performance against state-of-the-art rule-based APT detection systems.

An APT Attack Detection Method of a New-type Power System Based on STSA-transformer

Background: Complex structures such as a high proportion of power electronic equipment has brought new challenges to the safe and stable operation of new-type power system, increasing the possibility of the system being attacked, especially the more complex Advanced Persistent Threat (APT). This kind of attack has a long duration and strong concealment. Objective: Traditional detection methods target a relatively single attack mode, and the time span of APT processed is relatively short. None of them can effectively capture the long-term correlation in the attack, and the detection rate is low. These methods can’t meet the safety requirements of the new-type power system. In order to solve this problem, this paper proposes an improved transformer model called STSA-transformer algorithm, and applies it to the detection of APT in new-type power systems. Methods: In the STSA-transformer model, the network traffic collected from the power system is first converted into a sequence of feature vectors, and the location information and local feature of the sequence, is extracted by combining position encoding with convolutional embedding operations, and then global characteristics of attack sequences is captured using the multi-head selfattention mechanism of the transformer encoder, the higher-frequency features of the attention are extracted through the self-learning threshold operation, combined with the PowerNorm algorithm to standardize the samples, and finally classify the network traffic of the APT. Results: After multiple rounds of training on the model, the expected effect can be achieved and applied to the APT detection of a new-type power system. Conclusion: The experimental results show that the proposed STSA-transformer algorithm has better detection accuracy and lower detection false-alarm rate than traditional deep learning algorithms and machine learning algorithms.

Fuzzy inference based feature selection and optimized deep learning for Advanced Persistent Threat attack detection

SummaryOne of the attacks that have rapidly happen is Advanced Persistent Threat (APT). APT attacks contain different sophisticated approaches and methods of attacking targets for stealing confidential as well as sensitive information. This research introduced novel and effective APT attack detection techniques, namely Smart Flower Cosine Algorithm‐driven Deep Convolutional Neural Network (SFCA‐DeepCNN). Here, the APT attack detection is done by the DeepCNN, wherein the weight of DeepCNN is updated by the proposed SFCA. The SFCA is modeled by unifying the Smart Flower Optimization Algorithm (SFOA) and Sine Cosine Algorithm (SCA). Additionally, the pre‐processing process is done by Quantile normalization, and the features are chosen based on the fuzzy‐based distance measures. Moreover, data augmentation is done to increase the size of data by performing the oversampling that avoids the overfitting problems. Furthermore, the proposed optimized deep learning scheme detects the accurate APT detection outcome. The performance improvement of the proposed method for testing accuracy is 9.417%, 10.47%, 4.232%, and 3.068% higher than the existing methods, such as, Deep Learning, Support Vector Machine (SVM), Bidirectional Long Short‐Term Memory (Bi‐LSTM), and Hidden Markov Model (HMM).

APTSHIELD: A Stable, Efficient and Real-Time APT Detection System for Linux Hosts

Advanced Persistent Threat (APT) attack usually refers to the form of long-term, covert and sustained attack on specific targets, with an adversary using advanced attack techniques to destroy the key facilities of an organization. APT attacks have caused serious security threats and massive financial loss worldwide. Academics and industry thereby have proposed a series of solutions to detect APT attacks, such as dynamic/static code analysis, traffic detection, sandbox technology, endpoint detection and response (EDR), etc. However, existing defenses are failed to accurately and effectively defend against the current APT attacks that exhibit strong persistent, stealthy, diverse and dynamic characteristics due to the weak data source integrity, large data processing overhead and poor real-time performance in the process of real-world scenarios. To overcome these difficulties, in this paper we propose APTSHIELD, a stable, efficient and real-time APT detection system for Linux hosts. In the aspect of data collection, audit is selected to stably collect kernel data of the operating system so as to carry out a complete portrait of the attack based on comprehensive analysis and comparison of existing logging tools; In the aspect of data processing, redundant semantics skipping and non-viable node pruning are adopted to reduce the amount of data, so as to reduce the overhead of the detection system; In the aspect of attack detection, an APT attack detection framework based on ATT&CK model is designed to carry out real-time attack response and alarm through the transfer and aggregation of labels. Experimental results on both laboratory and Darpa Engagement show that our system can effectively detect web vulnerability attacks, file-less attacks and remote access trojan attacks, and has a low false positive rate, which adds far more value than the existing frontier work.

A prospective approach to detect advanced persistent threats: Utilizing hybrid optimization technique

Advanced Persistent Threat (APT) attacks pose significant challenges for AI models in detecting and mitigating sophisticated and highly effective cyber threats. This research introduces a novel concept called Hybrid HHOSSA which is the grouping of Harris Hawk Optimization (HHO) and Sparrow Search Algorithm (SSA) characteristics for optimizing the feature selection and data balancing in the context of APT detection. In addition, the light GBM as well as the weighted average Bi-LSTM are optimized by the proposed hybrid HHOSSA optimization. The HHOSSA-based attribute selection is used to choose the most important attributes from the provided dataset in the early step of the quasi-identifier detection. The HHOSSA-SMOTE algorithm effectively balances the unbalanced data, such as the lateral movements and the data exfiltration in the DAPT 2020 database, which further improves the classifier performance. The light GBM and the Bi-LSTM classifier hyperparameters are well attuned and classified by the HHOSSA optimization for the precise classification of the attacks. The outcome of both the optimized light GBM and the Bi-LSTM classifier generates the final prediction of the attacks existing in the network. According to the research findings, the HHOSSA-hybrid classifier achieves high accuracy in detecting attacks, with an accuracy rate of 94.468 %, a sensitivity of 94.650 %, and a specificity of 95.230 % with a K-fold value of 10. Also, the HHOSSA-hybrid classifier achieves the highest AUC percentage of 97.032, highlighting its exceptional performance in detecting APT attacks.

System-level data management for endpoint advanced persistent threat detection: Issues, challenges and trends

Advanced persistent threat (APT) attacks pose significant security threats to governments and large enterprises. Endpoint detection and response (EDR) methods, which are standard solutions to combat APT attacks, can efficaciously respond to associated security threats by leveraging the semantic richness of provenance graphs and clear causality relations to resist illegal tampering. However, the large number of audit logs produced over time, which provide key supporting information for EDR methods, lead to substantial computational overhead and increased storage costs. Therefore, a robust data management framework must be developed. However, most existing reviews discuss data collection, compression, and storage methods independently. Due to the lack of a comprehensive, structured survey of data management strategies, current data management analyses tend to be separated into individual modules, making it difficult to obtain prompt and precise guidance for higher-level security analysis tasks from these analyses. In this paper, a comprehensive and structured survey of data management strategies based on provenance graphs is conducted, the core ideas of the mainstream approaches to each aspect of data management are summarized, and existing approaches are systematically classified and compared. Then, the problems with individual data management modules are investigated, and potential complementary and collaborative strategies are examined based on the insights and challenges of existing work as a basis for recommending best practices for practical deployment. Finally, an ideal data management framework is described to guide future research.

Machine Learning for APT Detection

Nowadays, countries face a multitude of electronic threats that have permeated almost all business sectors, be it private corporations or public institutions. Among these threats, advanced persistent threats (APTs) stand out as a well-known example. APTs are highly sophisticated and stealthy computer network attacks meticulously designed to gain unauthorized access and persist undetected threats within targeted networks for extended periods. They represent a formidable cybersecurity challenge for governments, corporations, and individuals alike. Recognizing the gravity of APTs as one of the most critical cybersecurity threats, this study aims to reach a deeper understanding of their nature and propose a multi-stage framework for automated APT detection leveraging time series data. Unlike previous models, the proposed approach has the capability to detect real-time attacks based on stored attack scenarios. This study conducts an extensive review of existing research, identifying its strengths, weaknesses, and opportunities for improvement. Furthermore, standardized techniques have been enhanced to enhance their effectiveness in detecting APT attacks. The learning process relies on datasets sourced from various channels, including journal logs, traceability audits, and systems monitoring statistics. Subsequently, an efficient APT detection and prevention system, known as the composition-based decision tree (CDT), has been developed to operate in complex environments. The obtained results demonstrate that the proposed approach consistently outperforms existing algorithms in terms of detection accuracy and effectiveess.

A Systematic Literature Review and a Conceptual Framework Proposition for Advanced Persistent Threats (APT) Detection for Mobile Devices Using Artificial Intelligence Techniques

Advanced persistent threat (APT) refers to a specific form of targeted attack used by a well-organized and skilled adversary to remain undetected while systematically and continuously exfiltrating sensitive data. Various APT attack vectors exist, including social engineering techniques such as spear phishing, watering holes, SQL injection, and application repackaging. Various sensors and services are essential for a smartphone to assist in user behavior that involves sensitive information. Resultantly, smartphones have become the main target of APT attacks. Due to the vulnerability of smartphone sensors, several challenges have emerged, including the inadequacy of current methods for detecting APTs. Nevertheless, several existing APT solutions, strategies, and implementations have failed to provide comprehensive solutions. Detecting APT attacks remains challenging due to the lack of attention given to human behavioral factors contributing to APTs, the ambiguity of APT attack trails, and the absence of a clear attack fingerprint. In addition, there is a lack of studies using game theory or fuzzy logic as an artificial intelligence (AI) strategy for detecting APT attacks on smartphone sensors, besides the limited understanding of the attack that may be employed due to the complex nature of APT attacks. Accordingly, this study aimed to deliver a systematic review to report on the extant research concerning APT detection for mobile sensors, applications, and user behavior. The study presents an overview of works performed between 2012 and 2023. In total, 1351 papers were reviewed during the primary search. Subsequently, these papers were processed according to their titles, abstracts, and contents. The resulting papers were selected to address the research questions. A conceptual framework is proposed to incorporate the situational awareness model in line with adopting game theory as an AI technique used to generate APT-based tactics, techniques, and procedures (TTPs) and normal TTPs and cognitive decision making. This framework enhances security awareness and facilitates the detection of APT attacks on smartphone sensors, applications, and user behavior. It supports researchers in exploring the most significant papers on APTs related to mobile sensors, services, applications, and detection techniques using AI.

Blockchain-Based AI-Enabled Industry 4.0 CPS Protection Against Advanced Persistent Threat

Industry 4.0 is all about doing things in a concurrent, secure, and fine-grained manner. IoT edge-sensors and their associated data play a predominant role in today's industry ecosystem. Breaching data or forging source devices after injecting advanced persistent threats (APT) damages the industry owners' money and loss of operators' lives. The existing challenges include APT injection attacks targeting vulnerable edge devices, insecure data transportation, trust inconsistencies among stakeholders, incompliant data storing mechanisms, etc. Edge-servers often suffer because of their lightweight computation capacity to stamp out unauthorized data or instructions, which in essence, makes them exposed to attackers. When attackers target edge servers while transporting data using traditional PKI-rendered trusts, consortium blockchain (CBC) offers proven techniques to transfer and maintain those sensitive data securely. With the recent improvement of edge machine learning, edge devices can filter malicious data at their end which largely motivates us to institute a Blockchain and AI aligned APT detection system. The unique contributions of the paper include efficient APT detection at the edge and transparent recording of the detection history in an immutable blockchain ledger. In line with that, the certificateless data transfer mechanism boost trust among collaborators and ensure an economical and sustainable mechanism after eliminating existing certificate authority. Finally, the edge-compliant storage technique facilitates efficient predictive maintenance. The respective experimental outcomes reveal that the proposed technique outperforms the other competing systems and models.

E-APTDetect: Early Advanced Persistent Threat Detection in Critical Infrastructures with Dynamic Attestation

Advanced Persistent Threats (APTs) represent a complex series of techniques directed against a particular organization, where the perpetrator is able to hide its presence for a longer period of time (e.g., months, years). Previous such attacks have demonstrated the exceptional impact that a cyber attack may have on the operation of Supervisory Control And Data Acquisition Systems (SCADA), and, more specifically, on the underlying physical process. Existing techniques for the detection of APTs focus on aggregating results originating from a collection of anomaly detection agents. However, such approaches may require an extensive time period in case the process is in a steady-state. Conversely, this paper documents E-APTDetect, an approach that uses dynamic attestation and multi-level data fusion for the early detection of APTs. The methodology leverages sensitivity analysis and Dempster-Shafer’s Theory of Evidence as its building blocks. Extensive experiments are performed on a realistic Vinyl Acetate Monomer (VAM) process model. The model contains standard chemical unit operations and typical industrial characteristics, which make it suitable for a large variety of experiments. The experimental results conducted on the VAM process demonstrate E-APTDetect’s ability to efficiently detect APTs, but also highlight key aspects related to the attacker’s advantage. The experiments also highlight that the adversary’s advantage is affected by two major factors: the number of compromised components; and, the precision of manipulation.

APT Attack Detection Scheme Based on CK Sketch and DNS Traffic.

In recent years, Advanced Persistent Threat (APT) attacks against sensors have emerged as a prominent security concern. Due to the low level of protection provided by sensors, APT attack organizations are able to develop intrusion schemes that allow them to infiltrate, attack, lurk, spread, and steal information from the target over an extended period of time. Through extensive research on the APT attack process and current defense mechanisms, it has been found that analyzing Domain Name Server (DNS) traffic in the communication control phase is an effective way of detecting APT attacks. However, analyzing APT attacks based on traffic usually involves the detection of a vast amount of DNS traffic, and current data preprocessing methods do not scale down data effectively, leading to low detection efficiency. In previous work, most efforts have been focused on calculating the features of request messages or corresponding messages without considering the association between request messages and corresponding messages. To address these issues, we propose a sketch-based APT attack traffic detection scheme. The scheme leverages the sketch structure to count and compress network traffic, improving the efficiency of APT detection. Our work also analyzes the limitations of traditional sketches in network traffic and proposes an improved sketch scheme. In addition, we propose several effective features for detecting APT attacks. We validate and evaluate our solution using 1,088,280 DNS traffic from a lab network and APT suspicious traffic from netresec and contagio, using eight machine learning models. The experimental results show that for the ExtraTrees model, our solution has a processing time of 0.0638 s and an accuracy of 0.97920, reducing the processing time by approximately 50 times and improving detection accuracy by a small margin compared to a dataset without sketch processing.

Threat Defense through Cyber Fusion

Using cyber fusion to detect advanced persistent threats (APTs) is a complex task requiring integrating and correlating multiple sources of information and data. APTs are a specific type of cyber-attack where an attacker establishes a long-term, undetected presence on a target's network to steal sensitive information or disrupt operations. Due to the nature of APTs, it can be hard to detect them and take action. However, using threat intelligence is also a key component of APT detection. It provides actionable information about new APTs and the tactics and techniques used by APT attackers, allowing organizations to adapt their defenses and be proactive in their threat response. It is also essential to have a well-coordinated incident response plan and a skilled team to manage the system to ensure that all aspects of the system are working together effectively and efficiently. Consequently, this systematic review of academic and professional literature examines latent material that covers the use of cyber fusion to detect advanced persistent threats (APTs) in different IT environments.

Security Requirement Recommendation Method Using Case-Based Reasoning to Prevent Advanced Persistent Threats

As the world becomes digitized and connected, cyberattacks and security issues have been steadily increasing. In particular, advanced persistent threats (APTs) are actors who perform various complex attacks over the long term to achieve their purpose. These attacks involve more planning and intelligence than typical cyberattacks. Many studies have investigated APT detection and defense methods; however, studies on security requirements that focus on non-technical factors and prevention are relatively few. Therefore, this study aims to provide attack information to users obtained by analyzing attack scenarios as well as security requirements to help the users understand and make decisions. To this end, we propose a method for extracting attack elements by providing users with templates for attack scenarios with different levels of abstraction. In addition, we use a problem domain ontology that is based on the concept of a case to provide users with attack analysis results and recommended security requirements. Our method uses case-based reasoning to retrieve similar cases, recommend reusable security requirements, and propose revision directions. The ontology can be improved by adding the solution to the problem as a new case. We conducted case studies and surveys to evaluate our methods and showed that they help specify security requirements.

Anomaly-Based Intrusion Detection System To Detect Advanced Persistent Threats: Environmental Sustainability

In an evolving digital world, Advanced Persistent Threats (APTs) pose severe cybersecurity challenges. These extended, stealthy cyber-attacks, often elude conventional Intrusion Detection Systems (IDS). To bridge this gap, our research introduces a novel, environmentally conscious, deep learning-based IDS designed for APT detection. The system encompasses various stages from objective definition, data collection and preprocessing, to model development, integration, validation, and deployment. The system, utilizing deep learning algorithms, scrutinizes network traffic to detect patterns characteristic of APTs. This approach improves IDS accuracy and allows real-time threat detection, enabling prompt response to potential threats. Importantly, our system contributes to environmental protection by minimizing power consumption and electronic waste associated with cyberattacks, promoting sustainable cybersecurity practices. Our research outcomes are expected to enhance APT detection, providing robust defense against sophisticated cyber threats. Our environmentally-conscious perspective adds a unique dimension to the cybersecurity domain, underlining its role in sustainable practices.

Strategic Monitoring for Efficient Detection of Simultaneous APT Attacks with Limited Resources

Advanced Persistent Threats (APT) are a type of sophisticated multistage cyber attack, and the defense against APT is challenging. Existing studies apply signature-based or behavior-based methods to analyze monitoring data to detect APT, but little research has been dedicated to the important problem of addressing APT detection with limited resources. In order to maintain the primary functionality of a system, the resources allocated for security purposes, for example logging and examining the behavior of a system, are usually constrained. Therefore, when facing multiple simultaneous powerful cyber attacks like APT, the allocation of limited security resources becomes critical. The research in this paper focuses on the threat model where multiple simultaneous APT attacks exist in the defender’s system, but the defender does not have sufficient monitoring resources to check every running process. To capture the footprint of multistage activities including APT attacks and benign activities, this work leverages the provenance graph which is constructed based on dependencies of processes. Furthermore, this work studies the monitoring strategy to efficiently detect APT attacks from incomplete information of paths on the provenance graph, by considering both the “exploitation” effect and the “exploration” effect. The contributions of this work are two-fold. First, it extends the classic UCB algorithm in the domain of the multi-armed bandit problem to solve cyber security problems, and proposes to use the malevolence value of a path, which is generated by a novel LSTM neural network as the exploitation term. Second, the consideration of “exploration” is innovative in the detection of APT attacks with limited monitoring resources. The experimental results show that the use of the LSTM neural network is beneficial to enforce the exploitation effect as it satisfies the same property as the exploitation term in the classic UCB algorithm and that by using the proposed monitoring strategy, multiple simultaneous APT attacks are detected more efficiently than using the random strategy and the greedy strategy, regarding the time needed to detect same number of APT attacks.

Blockchain-Integrated Advanced Persistent Threat Detection Using Optimized Deep Learning-Enabled Feature Fusion

Through Advanced Persistent Threats (APTs), which can reveal data alteration, destruction, or Denial of Service attacks through the examples of exposed hardware and software, the information technology model advances. Moving Target (MTD) is a promising risk-reduction strategy that primarily relies on APTs by utilizing dynamic and randomization techniques on properties that are collaborated. Although there are various MTD approaches to implement the blind random mutation, it still produces better performance overhead as well as poor defense utility. Additionally, APT is a unique assault strategy that was typically developed by hacking groups to steal data or deactivate systems for enormous originalities and uniform countries. APT is a multi-stage, long-term representative, and it is difficult to identify attacks effectively using an outmoded approach. In this paper, Conditional Dingo Optimization Algorithm Deep Residual Network (CDOA-based DRN) is devised for APT detection. Moreover, correlation Tversky index-based similarity is designed for performing feature fusion. The hybrid optimization algorithm effectively increases the performance and reduces various real-world issues. Testing accuracy, True Positive Rate, and False Positive Rate of the newly developed CDOA-based DRN are 95.43%, 96.34%, and 91.43%, respectively, for better performance.