APT Encrypted Traffic Detection Method based on Two-Parties and Multi-Session for IoT

Abstract

The rise of IoT devices has led to an increase in network endpoints, making Advanced Persistent Threat (APT) attacks a significant concern. APT attacks typically use encrypted communication protocols, making traditional detection methods less effective. Machine learning-based APT encrypted traffic detection methods have been proposed but are limited in their efficacy. In this paper, we propose a novel APT encrypted traffic detection method based on two parties and multi-session analysis. The method extracts a limited set of features from network traffic, including session sequence, session time interval, upstream and downstream data size, which are then transformed into images. These images are subsequently fed into a convolutional neural network (CNN) to recognize patterns and identify network traffic. The proposed method was evaluated through five experiments, demonstrating significant success in detecting APT attacks. The use of multi-session analysis provided a comprehensive view of network traffic, enabling more accurate APT attack detection. The proposed method offers potential for deployment in enterprise security, with implications for the development of more effective APT detection methods.