Systematic Mapping of Detection Techniques for Advanced Persistent Threats

Sobrín-Hidalgo, David; Vega, Adrián Campazas; Higueras, Ángel Manuel Guerrero; Lera, Francisco Javier Rodríguez; Fernández‐Llamas, Camino

doi:10.1007/978-3-030-57805-3_40

Cited by 2 publications

(4 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…So, after our analysis, KNN was the best classifier. KNN is also one of the most used algorithms in the literature to detect malicious traffic, as shown in [ 6 ]. In [ 6 ], the authors established that decision trees and NB are commonly used to detect malicious traffic.…”

Section: Discussionmentioning

confidence: 99%

“…KNN is also one of the most used algorithms in the literature to detect malicious traffic, as shown in [ 6 ]. In [ 6 ], the authors established that decision trees and NB are commonly used to detect malicious traffic. In our research, decision trees also presented good performance with accuracy,

, and

scores higher than 0.9.…”

Section: Discussionmentioning

confidence: 99%

“…Regarding NB, despite it presenting a high accuracy score using

, it did not ensure generalization since its accuracy considerably decreased when testing with

. We attribute this difference to most works described in [ 6 ] not including a validation step. Thus, we can empirically assert that models fitted with data gathered by DOROTHEA could detect malicious traffic.…”

Section: Discussionmentioning

confidence: 99%

“…Using a hybrid method, Reference [ 5 ] proposed a graphical-feature-based approach obtaining a 98.54% accuracy score with a model using a K-nearest neighbors (KNN) algorithm. In [ 6 ], the authors carried out a literature review map in order to establish the most commonly used datasets and algorithms to detect cyberattacks. Results showed that the UNSW-NB15 dataset provided good performance when classifying network traffic.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Flow-Data Gathering Using NetFlow Sensors for Fitting Malicious-Traffic Detection Models

Campazas-Vega

Crespo-Martínez

Guerrero‐Higueras

et al. 2020

Sensors

Self Cite

View full text Add to dashboard Cite

Advanced persistent threats (APTs) are a growing concern in cybersecurity. Many companies and governments have reported incidents related to these threats. Throughout the life cycle of an APT, one of the most commonly used techniques for gaining access is network attacks. Tools based on machine learning are effective in detecting these attacks. However, researchers usually have problems with finding suitable datasets for fitting their models. The problem is even harder when flow data are required. In this paper, we describe a framework to gather flow datasets using a NetFlow sensor. We also present the Docker-based framework for gathering netflow data (DOROTHEA), a Docker-based solution implementing the above framework. This tool aims to easily generate taggable network traffic to build suitable datasets for fitting classification models. In order to demonstrate that datasets gathered with DOROTHEA can be used for fitting classification models for malicious-traffic detection, several models were built using the model evaluator (MoEv), a general-purpose tool for training machine-learning algorithms. After carrying out the experiments, four models obtained detection rates higher than 93%, thus demonstrating the validity of the datasets gathered with the tool.

show abstract

Section: Discussionmentioning

confidence: 99%