Cybersecurity faces enormous obstacles from advanced persistent threats (APTs) because of their smart and enduring nature. Because of APTs’ weak and sluggish assault methods, conventional intrusion detection systems sometimes have trouble identifying them. In order to improve APT attack detection, this study suggests a hybrid ensemble machine learning model that makes use of anomalous behavior detection approaches in network activity. The suggested model combines several machine learning techniques to produce a reliable detection system. Performance evaluations show that the hybrid ensemble model significantly increases detection accuracy and reduces false positives when compared to current methods. Using network behavior anomaly detection, this study proposes a hybrid ensemble machine learning model that combines the random forest and XGBoost algorithms to improve the identification of APTs. The model achieves better classification performance by utilizing the advantages of both algorithms: XGBoost's efficiency and accuracy and random forest's resistance to overfitting. Using strategies like feature scaling and dimensionality reduction, we preprocess network traffic data to identify pertinent features suggestive of both normal and aberrant activity. A tagged dataset that replicates both benign and APT-related network activity is used to train the hybrid model. Performance indicators like accuracy, precision, recall, and F1-score are used to evaluate the model's efficacy. The suggested hybrid strategy works noticeably better than standalone models, according to experimental data, which also show a notable decrease in false positives while retaining high APT detection rates.