Machine learning for APT detection

Al-Aamri, Abdullah Said Ali and Abdulghafor, Rawad Abdulkhaleq Abdulmolla and Turaev, Sherzod and Al-Shaikhli, Imad Fakhri Taha and Zeki, Akram M. and Talib, Shuhaili (2023) Machine learning for APT detection. Sustainability (Switzerland), 15 (18). pp. 1-16. E-ISSN 2071-1050

	PDF (Journal) - Published Version Restricted to Registered users only Download (1MB) | Request a copy
Preview	PDF (Scopus) - Supplemental Material Download (181kB) | Preview
	PDF - Published Version Restricted to Registered users only Download (403kB) | Request a copy

Abstract

Nowadays, countries face a multitude of electronic threats that have permeated almost all business sectors, be it private corporations or public institutions. Among these threats, advanced persistent threats (APTs) stand out as a well-known example. APTs are highly sophisticated and stealthy computer network attacks meticulously designed to gain unauthorized access and persist undetected threats within targeted networks for extended periods. They represent a formidable cybersecurity challenge for governments, corporations, and individuals alike. Recognizing the gravity of APTs as one of the most critical cybersecurity threats, this study aims to reach a deeper understanding of their nature and propose a multi-stage framework for automated APT detection leveraging time series data. Unlike previous models, the proposed approach has the capability to detect real-time attacks based on stored attack scenarios. This study conducts an extensive review of existing research, identifying its strengths, weaknesses, and opportunities for improvement. Furthermore, standardized techniques have been enhanced to enhance their effectiveness in detecting APT attacks. The learning process relies on datasets sourced from various channels, including journal logs, traceability audits, and systems monitoring statistics. Subsequently, an efficient APT detection and prevention system, known as the composition-based decision tree (CDT), has been developed to operate in complex environments. The obtained results demonstrate that the proposed approach consistently outperforms existing algorithms in terms of detection accuracy and effectiveness.

Item Type:	Article (Journal)
Uncontrolled Keywords:	APT, attacks, artificial intelligence, CDT
Subjects:	T Technology > T Technology (General) > T10.5 Communication of technical information
Kulliyyahs/Centres/Divisions/Institutes (Can select more than one option. Press CONTROL button):	Kulliyyah of Information and Communication Technology Kulliyyah of Information and Communication Technology Kulliyyah of Information and Communication Technology > Department of Computer Science Kulliyyah of Information and Communication Technology > Department of Computer Science
Depositing User:	Ms Shuhaili Talib
Date Deposited:	20 Nov 2023 17:02
Last Modified:	17 Jan 2024 08:58
URI:	http://irep.iium.edu.my/id/eprint/108265

Actions (login required)

View Item