A New Realistic Benchmark for Advanced Persistent Threats in Network Traffic

Liu, Jinxin; Shen, Yu; Şimşek, Murat; Kantarcı, Burak; Mouftah, Hussein T.; Bagheri, Mehran; Djukic, Petar

doi:10.1109/lnet.2022.3185553

Cited by 12 publications

(4 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although research in [19] had relatively poor performance, Liu and his team's work [20] outperformed the baseline models with a maximum macro-average F1 score of 82.27% that corresponds to 9.4% improvement with respect to the baseline performance. Work on Liu's benchmark dataset [20] was carried out in [21] where the authors proposed a machine learning-based model named Prior Knowledge Input (PKI). PKI utilized unsupervised clustering methodologies to preclassify the original dataset to obtain prior knowledge which eventually is incorporated onto the supervised model that minimizes training complexity.…”

Section: Related Workmentioning

confidence: 94%

“…The authors through experimentation with semi-supervised approach reported having class imbalance in their dataset that ultimately led their model to perform poorly to detect attacks. The problem of class imbalance was also found in the contribution of another similar benchmark contribution named SCVIC-APT-2021 [20] where the authors had better luck with ensemble methods and an machine learningbased Attack Centric Method (ACM) is proposed to evaluate the model performance on contributed dataset. Although research in [19] had relatively poor performance, Liu and his team's work [20] outperformed the baseline models with a maximum macro-average F1 score of 82.27% that corresponds to 9.4% improvement with respect to the baseline performance.…”

Section: Related Workmentioning

confidence: 96%

“…The problem of class imbalance was also found in the contribution of another similar benchmark contribution named SCVIC-APT-2021 [20] where the authors had better luck with ensemble methods and an machine learningbased Attack Centric Method (ACM) is proposed to evaluate the model performance on contributed dataset. Although research in [19] had relatively poor performance, Liu and his team's work [20] outperformed the baseline models with a maximum macro-average F1 score of 82.27% that corresponds to 9.4% improvement with respect to the baseline performance. Work on Liu's benchmark dataset [20] was carried out in [21] where the authors proposed a machine learning-based model named Prior Knowledge Input (PKI).…”

Section: Related Workmentioning

confidence: 96%

“…The dataset SCVIC-APT-2021 [23] is taken from the research work carried out in [20] and is one of the latest benchmark datasets of 2022 for detecting Advanced Persistent Threats (APT) in network traffics. The dataset contains 315,607 rows of data and 84 features in total.…”

Section: Dataset Descriptionmentioning

confidence: 99%

See 3 more Smart Citations

Advanced Persistent Threat Identification with Boosting and Explainable AI

2023

View full text Add to dashboard Cite

Advanced persistent threat (APT) is a serious concern in cyber-security that has matured and grown over the years with the advent of technology. The main aim of this study is to establish an effective identification model for APT attacks to prevent and reduce their influence. Machine learning has the potential as well as substantial background to detect and predict cyber-security threats including APT. This study utilized several boosting-based machine learning methods to predict various types of APTs that are consistent in cyber-security domain. Furthermore, Explainable Artificial Intelligence (XAI) was coupled with the predictions to provide actionable insights to the domain stakeholders as well as practitioners in this domain. The results, particularly XGBoost with weighted F1 score of 0.97 and SHapley Additive exPlanations (SHAP)-based explanation, prove that boosting methods as well as machine learning models paired with XAI are indeed promising in handling cyber-security-related dataset problems which can be extrapolated towards new avenues of challenging research by effectively deploying boosting-based XAI models.

show abstract

Section: Related Workmentioning

confidence: 94%

Section: Related Workmentioning

confidence: 96%

Section: Related Workmentioning

confidence: 96%

Section: Dataset Descriptionmentioning

confidence: 99%

See 2 more Smart Citations

Advanced Persistent Threat Identification with Boosting and Explainable AI

2023

View full text Add to dashboard Cite

show abstract

Explainable deep learning approach for advanced persistent threats (APTs) detection in cybersecurity: a review

Mutalib,

Sabri,

Wahab

et al. 2024

Artif Intell Rev

View full text Add to dashboard Cite

In recent years, Advanced Persistent Threat (APT) attacks on network systems have increased through sophisticated fraud tactics. Traditional Intrusion Detection Systems (IDSs) suffer from low detection accuracy, high false-positive rates, and difficulty identifying unknown attacks such as remote-to-local (R2L) and user-to-root (U2R) attacks. This paper addresses these challenges by providing a foundational discussion of APTs and the limitations of existing detection methods. It then pivots to explore the novel integration of deep learning techniques and Explainable Artificial Intelligence (XAI) to improve APT detection. This paper aims to fill the gaps in the current research by providing a thorough analysis of how XAI methods, such as Shapley Additive Explanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME), can make black-box models more transparent and interpretable. The objective is to demonstrate the necessity of explainability in APT detection and propose solutions that enhance the trustworthiness and effectiveness of these models. It offers a critical analysis of existing approaches, highlights their strengths and limitations, and identifies open issues that require further research. This paper also suggests future research directions to combat evolving threats, paving the way for more effective and reliable cybersecurity solutions. Overall, this paper emphasizes the importance of explainability in enhancing the performance and trustworthiness of cybersecurity systems.

show abstract