Detection and Classification of Advanced Persistent Threats and Attacks Using the Support Vector Machine

Chu, Wen-Lin; Lin, Chih-Jer; Chang, Ke-Neng

doi:10.3390/app9214579

Cited by 36 publications

(31 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Chu et al have used the combined SVM-RBF method to detect APT attacks with 97.22% accuracy and the FPR value has not been reported in their work [9]. However, we achieved the accuracy of 98.85% using a 6-layer deep learning model, and the FPR value through our proposed model is 1.13.…”

Section: Resultsmentioning

confidence: 60%

Early Detection of the Advanced Persistent Threat Attack Using Performance Analysis of Deep Learning

et al. 2020

View full text Add to dashboard Cite

One of the most common and critical destructive attacks on the victim system is the advanced persistent threat (APT)-attack. An APT attacker can achieve its hostile goal through obtaining information and gaining financial benefits from the infrastructure of a network. One of the solutions to detect a unanimous APT attack is using network traffic. Due to the nature of the APT attack in terms of being on the network for a long time and the fact that the system may crash due to the high traffic, it is difficult to detect this type of attack. Hence, in this study, machine learning methods of C5.0 decision tree, Bayesian network, and deep learning are used for the timely detection and classification of APT-attacks on the NSL-KDD dataset. Moreover, a 10-fold cross-validation method is used to experiment with these models. As a result, the accuracy (ACC) of the C5.0 decision tree, Bayesian network, and 6-layer deep learning models is obtained as 95.64%, 88.37%, and 98.85%, respectively. Also, in terms of the critical criterion of the false positive rate (FPR), the FPR value for the C5.0 decision tree, Bayesian network, and 6-layer deep learning models is obtained as 2.56, 10.47, and 1.13, respectively. Other criterions such as sensitivity, specificity, accuracy, false-negative rate, and F-measure are also investigated for the models, and the experimental results show that the deep learning model with automatic multi-layered extraction of features has the best performance for timely detection of an APT-attack comparing to other classification models.

show abstract

Section: Resultsmentioning

confidence: 60%

Early Detection of the Advanced Persistent Threat Attack Using Performance Analysis of Deep Learning

et al. 2020

View full text Add to dashboard Cite

show abstract

“…It is necessary to mention that they have calculated only the accuracy parameter for the algorithms. In [9], Chu et al have used the NSL-KDD database to detect the attack and have utilized the PCA method to decrease the size of the classified data set and have concluded that the SVM algorithm with the radial basis function as the kernel has better performance comparing to the classification algorithms such as multilayer perceptron (MLP), decision tree of J48 and Naive Bayes reaching a detection accuracy of 97.22%. In an APT attack, since the attacker is following the program with great planning and precision, he makes every effort to behave normally on the network so that the detection tools do not notice his presence, and it makes it difficult to detect the attack.…”

Section: Related Workmentioning

confidence: 99%

<strong>Early Detection of The Advanced Persistent Threats Attacks Using Performance Analysis of Deep Learning</strong>

Joloudari¹,

Haderbadi²,

Mashmool³

et al. 2020

Preprint

View full text Add to dashboard Cite

One of the most common and important destructive attacks on the victim system is Advanced Persistent Threats (APT)-attack. The APT attacker can achieve his hostile goals by obtaining information and gaining financial benefits regarding the infrastructure of a network. One of the solutions to detect a secret APT attack is using network traffic. Due to the nature of the APT attack in terms of being on the network for a long time and the fact that the network may crash because of high traffic, it is difficult to detect this type of attack. Hence, in this study, machine learning methods such as C5.0 decision tree, Bayesian network and deep neural network are used for timely detection and classification of APT-attacks on the NSL-KDD data set. Moreover, 10-fold cross validation method is used to experiment these models. As a result, the accuracy (ACC) of the C5.0 decision tree, Bayesian network and 6-layer deep learning models is obtained as 95.64%, 88.37% and 98.85%, respectively, and also, in terms of the important criterion of the false positive rate (FPR), the FPR value for the C5.0 decision tree, Bayesian network and 6-layer deep learning models is obtained as 2.56, 10.47 and 1.13, respectively. Other criterions such as sensitivity, specificity, accuracy, false negative rate and F-measure are also investigated for the models, and the experimental results show that the deep learning model with automatic multi-layered extraction of features has the best performance for timely detection of an APT-attack comparing to other classification models.

show abstract

“…Currently, cyberattacks are becoming more diverse, sophisticated, targeted, and specialized. Such advanced persistent threats (APTs) [1][2][3] require detailed defense strategies. Research and development projects are being conducted on various information-security solutions to respond to these threats.…”

Section: Introductionmentioning

confidence: 99%

Decision-Making Method for Estimating Malware Risk Index

Kim

2019

Applied Sciences

View full text Add to dashboard Cite

Most recent cyberattacks have employed new and diverse malware. Various static and dynamic analysis methods are being introduced to detect and defend against these attacks. The malware that is detected by these methods includes advanced present threat (APT) attacks, which allow additional intervention by attackers. Such malware presents a variety of threats (DNS, C&C, Malicious IP, etc.) This threat information used to defend against variants of malicious attacks. However, the intelligence that is detected in this manner is used in the blocking policies of information-security systems. Consequently, it is difficult for staff who perform Computer Emergence Response Team security control to determine the extent to which cyberattacks such as malware are a potential threat. Additionally, it is difficult to use this intelligence to establish long-term defense strategies for specific APT attacks or implement intelligent internal security systems. Therefore, a decision-making model that identifies threat sources and malicious activities (MAs) that occur during the static and dynamic analysis of various types of collected malware and performs machine learning based on a quantitative analysis of these threat sources and activities is proposed herein. This model estimates malware risk indices (MRIs) in detail using an analytic hierarchy process to analyze malware and the probabilities of MAs. The analysis results were significant, as the consistency index of the estimated MRI values for 51300 types of malware, which were collected during a specific control period, was maintained at <0.051.

show abstract

Detection and Classification of Advanced Persistent Threats and Attacks Using the Support Vector Machine

Cited by 36 publications

References 18 publications

Early Detection of the Advanced Persistent Threat Attack Using Performance Analysis of Deep Learning

Early Detection of the Advanced Persistent Threat Attack Using Performance Analysis of Deep Learning

<strong>Early Detection of The Advanced Persistent Threats Attacks Using Performance Analysis of Deep Learning</strong>

Decision-Making Method for Estimating Malware Risk Index

Contact Info

Product

Resources

About