Scholarlink

<p>Nowadays, Advanced persistent threats (APT) attacks are not only increasing in number but also becoming more sophisticated, posing serious challenges for organizations in detecting and preventing these threats. Some approaches for detecting APT attacks based on network traffic analysis using artificial intelligence have initially brought many positive results. The trend of these studies often seeks to analyze and extract network flow information in network traffic to find unusual behaviors of APT attacks. However, these approaches still have certain disadvantages that limit detection results, including: i) Only process data sequentially, lack flexibility and do not filter and focus on important data; ii) the context in the data has not been defined and evaluated. Although this is important information, it is closely related and interdependent with abnormal signs. To overcome the above limitations, this study introduces an advanced learning ensemble, combining modern techniques such as Adaptive contextual (AC), Selective adversarial generation (SAG), BiLSTM (Bidirectional long short-term memory), and Transformer. The AC technique is used to adapt to different network traffic data, helping to distill important information and adapt itself to data with different numbers of attacks, demonstrating context preservation and detecting anomalous patterns. SAG is applied to create synthetic data to simulate hacker attack data, helping to balance and improve the learning ability of the model. BiLSTM and Transformer are integrated to exploit contextual relationships and long-term dependencies in data, enhancing data processing capabilities based on parallel computing and analysis techniques. Experimental results in the article show that the proposed model is 2–4% more effective than other studies on all measures. The experimental results of the study show that the proposed ACG-BT model has achieved an accuracy of up to 99.45% and an F1-score of 98.35% on a data set of 1,884 IP pairs extracted from more than 1.6 million flows. These figures demonstrate the model’s superior performance compared to existing methods, with improvements ranging from 2 to 4% across all metrics.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Ensemble learning-based adaptive and adversarial techniques for APT attack detection

  • 期刊论文

  • 发表日期：

    2025年6月3日

查看全文
  • Nguyen Thanh Tung,
  • Cho Do Xuan,
  • Vu Thanh Long

摘要

Nowadays, Advanced persistent threats (APT) attacks are not only increasing in number but also becoming more sophisticated, posing serious challenges for organizations in detecting and preventing these threats. Some approaches for detecting APT attacks based on network traffic analysis using artificial intelligence have initially brought many positive results. The trend of these studies often seeks to analyze and extract network flow information in network traffic to find unusual behaviors of APT attacks. However, these approaches still have certain disadvantages that limit detection results, including: i) Only process data sequentially, lack flexibility and do not filter and focus on important data; ii) the context in the data has not been defined and evaluated. Although this is important information, it is closely related and interdependent with abnormal signs. To overcome the above limitations, this study introduces an advanced learning ensemble, combining modern techniques such as Adaptive contextual (AC), Selective adversarial generation (SAG), BiLSTM (Bidirectional long short-term memory), and Transformer. The AC technique is used to adapt to different network traffic data, helping to distill important information and adapt itself to data with different numbers of attacks, demonstrating context preservation and detecting anomalous patterns. SAG is applied to create synthetic data to simulate hacker attack data, helping to balance and improve the learning ability of the model. BiLSTM and Transformer are integrated to exploit contextual relationships and long-term dependencies in data, enhancing data processing capabilities based on parallel computing and analysis techniques. Experimental results in the article show that the proposed model is 2–4% more effective than other studies on all measures. The experimental results of the study show that the proposed ACG-BT model has achieved an accuracy of up to 99.45% and an F1-score of 98.35% on a data set of 1,884 IP pairs extracted from more than 1.6 million flows. These figures demonstrate the model’s superior performance compared to existing methods, with improvements ranging from 2 to 4% across all metrics.