Early Detection of the Advanced Persistent Threat Attack Using Performance Analysis of Deep Learning

Joloudari, Javad Hassannataj; Haderbadi, Mojtaba; Mashmool, Amir; GhasemiGol, Mohammad; Band, Shahab S.; Mosavi, Amir

doi:10.1109/access.2020.3029202

Cited by 51 publications

(24 citation statements)

References 42 publications

(65 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The study in [142] shows that DT-based detection framework achieving up to 99.99% accuracy to identify Bot-IoT attacks using the public dataset Bot-IoT. Furthermore, the study in [72] demonstrates 95.64% overall accuracy in detecting APT attacks in NSL-KDD dataset via DT algorithm which deploys an early detection of these APT attacks. Thus, the proposed approach is suitable for APT attack detection due to APT long time presence in compromised systems.…”

Section: Supervised Machine Learning Methods For Network Intrusion De...mentioning

confidence: 92%

Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats

et al. 2022

View full text Add to dashboard Cite

Despite its technological benefits, Internet of Things (IoT) has cyber weaknesses due to the vulnerabilities in the wireless medium. Machine learning (ML)-based methods are widely used against cyber threats in IoT networks with promising performance. Advanced persistent threat (APT) is prominent for cybercriminals to compromise networks, and it is crucial to long-term and harmful characteristics. However, it is difficult to apply ML-based approaches to identify APT attacks to obtain a promising detection performance due to an extremely small percentage among normal traffic. There are limited surveys to fully investigate APT attacks in IoT networks due to the lack of public datasets with all types of APT attacks. It is worth to bridge the state-of-the-art in network attack detection with APT attack detection in a comprehensive review article. This survey article reviews the security challenges in IoT networks and presents the well-known attacks, APT attacks, and threat models in IoT systems. Meanwhile, signature-based, anomaly-based, and hybrid IDSs are summarized for IoT networks. The article highlights statistical insights regarding frequently applied ML-based methods against network intrusion. Finally, open issues and challenges for common network intrusion and APT attacks are presented for future research.

show abstract

Section: Supervised Machine Learning Methods For Network Intrusion De...mentioning

confidence: 92%

Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats

et al. 2022

View full text Add to dashboard Cite

show abstract

“…A deep learning model on the NSL‐KDD dataset for APT attack identification with automated feature extraction was proposed by Javad Hassannataj et al 10 The researchers used a multi‐layered neural network model during the experimental phase to differentiate machine learning methodologies (such as C5.0 decision tree and Bayesian network). The multi‐layered deep neural network model outperformed the other techniques in the trials.…”

Section: Related Workmentioning

confidence: 99%

A hybrid ensemble machine learning model for detecting APT attacks based on network behavior anomaly detection

Saini,

Bhat Kasaragod,

Prakasha

et al. 2023

Concurrency and Computation

View full text Add to dashboard Cite

SummaryA persistent, targeted cyber attack is called an advanced persistent threat (APT) attack. The attack is mainly launched to gain sensitive information, take over the system, and for financial gain, which creates nowadays more hurdles and challenges for the organization in preventing, detecting, and recovering from such attacks. Due to the nature of APT attacks, it is difficult to detect them quickly. Therefore machine learning techniques come into these research areas. This study uses deep and machine learning models such as random forest, decision tree, convolutional neural network, multilayer perceptron and so forth to categorize and effectively detect APT attacks by utilizing publicly accessible datasets. The datasets used in this study are CSE‐CIC‐IDS2018, CIC‐IDS2017, NSL‐KDD, and UNSW‐NB15. This study proposes the hybrid ensemble machine learning model, a mixed approach of random forest and XGBoost classifiers. It has obtained the maximum prediction accuracy of 98.92%, 99.91%, 99.24%, and 97.11% for datasets CSE‐CIC‐IDS2018, CIC‐IDS2017, NSL‐KDD, and UNSW‐NB15, with a false positive rate of 0.52%, 0.12%, 0.62%, and 5.29% respectively. These results are compared to other closely related recent studies in the literature. Our experiment's findings show that our model has performed significantly better for all datasets.

show abstract

“…Joloudari et al [11] detected and classified APT attacks using three artificial intelligence (AI)based classification models: Bayesian network, C5.0 decision tree, and deep learning. They achieved improved detection accuracy by using a deep learning model to train and analyze APT attack patterns.…”

Section: Apt Attack Detection and Responsementioning

confidence: 99%

An Effective Threat Detection Framework for Advanced Persistent Cyberattacks

Jeon¹,

Lee²,

Lee³

et al. 2023

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

Recently, with the normalization of non-face-to-face online environments in response to the COVID-19 pandemic, the possibility of cyberattacks through endpoints has increased. Numerous endpoint devices are managed meticulously to prevent cyberattacks and ensure timely responses to potential security threats. In particular, because telecommuting, telemedicine, and teleeducation are implemented in uncontrolled environments, attackers typically target vulnerable endpoints to acquire administrator rights or steal authentication information, and reports of endpoint attacks have been increasing considerably. Advanced persistent threats (APTs) using various novel variant malicious codes are a form of a sophisticated attack. However, conventional commercial antivirus and anti-malware systems that use signature-based attack detection methods cannot satisfactorily respond to such attacks. In this paper, we propose a method that expands the detection coverage in APT attack environments. In this model, an open-source threat detector and log collector are used synergistically to improve threat detection performance. Extending the scope of attack log collection through interworking between highly accessible open-source tools can efficiently increase the detection coverage of tactics and techniques used to deal with APT attacks, as defined by MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK). We implemented an attack environment using an APT attack scenario emulator called Carbanak and analyzed the detection coverage of Google Rapid Response (GRR), an open-source threat detection tool, and Graylog, an open-source log collector. The proposed method expanded the detection coverage against MITRE ATT&CK by approximately 11% compared with that conventional methods.

show abstract

Early Detection of the Advanced Persistent Threat Attack Using Performance Analysis of Deep Learning

Cited by 51 publications

References 42 publications

Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats

Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats

A hybrid ensemble machine learning model for detecting APT attacks based on network behavior anomaly detection

An Effective Threat Detection Framework for Advanced Persistent Cyberattacks

Contact Info

Product

Resources

About