A Novel Machine Learning Model for Early Detection of Advanced Persistent Threats Utilizing Semi-Synthetic Network Traffic Data

Authors

  • Nadim Ibrahim Vel Tech Rangarajan Dr. Sagunthala R&D Institute of Science and Technology
  • N.R. Rajalakshmi Vel Tech Rangarajan Dr. Sagunthala R&D Institute of Science and Technology
  • Karam Hammadeh Vel Tech Rangarajan Dr. Sagunthala R&D Institute of Science and Technology

Keywords:

APTGuard, Advanced Persistent Threats, APTs, Machine learning, LSTM, SVM, KNN, LR

Abstract

Advanced Persistent Threats are not merely a buzzword, these highly sophisticated and stealthy cyber threats are characterized by their ability to infiltrate and persistently operate within target systems for extended periods, often remaining undetected until significant damage has been done. APTs have emerged as a formidable adversary, and it frequently attack important infrastructure, government entities, and private businesses. This research paper embarks on an examination of APTs, shedding light on their characteristics and strategies. The proposed model APTGuard in the paper presents vital way to detect and counter this menace effectively, employing a methodology that involves utilizing a Semi-Synthetic dataset using 6.8 Million samples of processed network flows for training and testing. Orchestrating four pivotal phases: data collection, feature selection, data pre-processing and applying of machine learning algorithms. Encompassing the application of the algorithms: long short-term memory (LSTM), logistic regression (LR), support vector machine (SVM), and k-nearest neighbours (KNN), with comparing the results, the paper emphasizes that APT Guard, achieves a notable accuracy of 99.89 % using 83 features. The paper makes a substantial contribution to create effective method for detecting and resist hidden and malicious APTs

Downloads

Published

2024-08-01

How to Cite

Nadim, I., N.R. Rajalakshmi, & Karam Hammadeh. (2024). A Novel Machine Learning Model for Early Detection of Advanced Persistent Threats Utilizing Semi-Synthetic Network Traffic Data. Journal of VLSI Circuits and Systems, 6(2), 31–39. Retrieved from https://vlsijournal.com/index.php/vlsi/article/view/122