Among all cyber threats the Advanced Persistent Threat (APT) stands as a stealthy and lethal type. Threats which belong to APT persist inside networks during prolonged periods of time spanning years to accomplish data collection for critical system compromise. Standard security solutions fail to detect these threats. Standard security measures prove ineffective for detecting APTs because they maintain patterns similar to normal network behavior. This paper demonstrates how the unsupervised machine learning algorithm Isolation Forest allows detection of insidious attacks by focusing on its application. The isolation of deviant network traffic patterns by the Isolation Forest algorithm enables it to identify APTs as anomalous patterns. This study analyzed the Linux-APT-Dataset-2024 through the implemented technique which includes benign and malicious network traffic records. The research findings show that Transparent Isolation Forest functions as an effective industrial tool to bolster cybersecurity protection since it enables system users to detect potential threats before they execute attacks. Adding Transparent Isolation Forest to real-time monitoring systems offers companies early access to APT detection which stakeholders can use to stop data breaches and limit infiltration time. Future adaptability of this approach for new threats can be achieved by its integration with different machine learning methods which would help boost its detection precision.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Advanced Persistent Threat Detection Using Isolation Forest Algorithm

  • S. Priya,
  • M. Vishal,
  • T. Vishal

摘要

Among all cyber threats the Advanced Persistent Threat (APT) stands as a stealthy and lethal type. Threats which belong to APT persist inside networks during prolonged periods of time spanning years to accomplish data collection for critical system compromise. Standard security solutions fail to detect these threats. Standard security measures prove ineffective for detecting APTs because they maintain patterns similar to normal network behavior. This paper demonstrates how the unsupervised machine learning algorithm Isolation Forest allows detection of insidious attacks by focusing on its application. The isolation of deviant network traffic patterns by the Isolation Forest algorithm enables it to identify APTs as anomalous patterns. This study analyzed the Linux-APT-Dataset-2024 through the implemented technique which includes benign and malicious network traffic records. The research findings show that Transparent Isolation Forest functions as an effective industrial tool to bolster cybersecurity protection since it enables system users to detect potential threats before they execute attacks. Adding Transparent Isolation Forest to real-time monitoring systems offers companies early access to APT detection which stakeholders can use to stop data breaches and limit infiltration time. Future adaptability of this approach for new threats can be achieved by its integration with different machine learning methods which would help boost its detection precision.