Machine Learning for APT Detection

Abdullah Said AL-Aamri, Rawad Abdulghafor, Sherzod Turaev, Imad Al-Shaikhli, Akram Zeki, Shuhaili Talib

Research output: Contribution to journalArticlepeer-review

Abstract

Nowadays, countries face a multitude of electronic threats that have permeated almost all business sectors, be it private corporations or public institutions. Among these threats, advanced persistent threats (APTs) stand out as a well-known example. APTs are highly sophisticated and stealthy computer network attacks meticulously designed to gain unauthorized access and persist undetected threats within targeted networks for extended periods. They represent a formidable cybersecurity challenge for governments, corporations, and individuals alike. Recognizing the gravity of APTs as one of the most critical cybersecurity threats, this study aims to reach a deeper understanding of their nature and propose a multi-stage framework for automated APT detection leveraging time series data. Unlike previous models, the proposed approach has the capability to detect real-time attacks based on stored attack scenarios. This study conducts an extensive review of existing research, identifying its strengths, weaknesses, and opportunities for improvement. Furthermore, standardized techniques have been enhanced to enhance their effectiveness in detecting APT attacks. The learning process relies on datasets sourced from various channels, including journal logs, traceability audits, and systems monitoring statistics. Subsequently, an efficient APT detection and prevention system, known as the composition-based decision tree (CDT), has been developed to operate in complex environments. The obtained results demonstrate that the proposed approach consistently outperforms existing algorithms in terms of detection accuracy and effectiveess.

Original languageEnglish
Article number13820
JournalSustainability (Switzerland)
Volume15
Issue number18
DOIs
Publication statusPublished - Sept 2023

Keywords

  • APT
  • CDT
  • artificial intelligence
  • attacks

ASJC Scopus subject areas

  • Computer Science (miscellaneous)
  • Geography, Planning and Development
  • Renewable Energy, Sustainability and the Environment
  • Environmental Science (miscellaneous)
  • Energy Engineering and Power Technology
  • Hardware and Architecture
  • Computer Networks and Communications
  • Management, Monitoring, Policy and Law

Fingerprint

Dive into the research topics of 'Machine Learning for APT Detection'. Together they form a unique fingerprint.

Cite this