APT-Attack Detection Based on Multi-Stage Autoencoders
In the face of emerging technological achievements, cyber security remains a significant issue. Despite the new possibilities that arise with such development, these do not come without a drawback. Attackers make use of the new possibilities to take advantage of possible security defects in new syst...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-07-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/12/13/6816 |
| _version_ | 1797480770495840256 |
|---|---|
| author | Helmut Neuschmied Martin Winter Branka Stojanović Katharina Hofer-Schmitz Josip Božić Ulrike Kleb |
| author_facet | Helmut Neuschmied Martin Winter Branka Stojanović Katharina Hofer-Schmitz Josip Božić Ulrike Kleb |
| author_sort | Helmut Neuschmied |
| collection | DOAJ |
| description | In the face of emerging technological achievements, cyber security remains a significant issue. Despite the new possibilities that arise with such development, these do not come without a drawback. Attackers make use of the new possibilities to take advantage of possible security defects in new systems. Advanced-persistent-threat (APT) attacks represent sophisticated attacks that are executed in multiple steps. In particular, network systems represent a common target for APT attacks where known or yet undiscovered vulnerabilities are exploited. For this reason, intrusion detection systems (IDS) are applied to identify malicious behavioural patterns in existing network datasets. In recent times, machine-learning (ML) algorithms are used to distinguish between benign and anomalous activity in such datasets. The application of such methods, especially autoencoders, has received attention for achieving good detection results for APT attacks. This paper builds on this fact and applies several autoencoder-based methods for the detection of such attack patterns in two datasets created by combining two publicly available benchmark datasets. In addition to that, statistical analysis is used to determine features to supplement the anomaly detection process. An anomaly detector is implemented and evaluated on a combination of both datasets, including two experiment instances–APT-attack detection in an independent test dataset and in a zero-day-attack test dataset. The conducted experiments provide promising results on the plausibility of features and the performance of applied algorithms. Finally, a discussion is provided with suggestions of improvements in the anomaly detector. |
| first_indexed | 2024-03-09T22:04:52Z |
| format | Article |
| id | doaj.art-c39f31675b7f4e1ead71ee649e585855 |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-09T22:04:52Z |
| publishDate | 2022-07-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-c39f31675b7f4e1ead71ee649e5858552023-11-23T19:43:08ZengMDPI AGApplied Sciences2076-34172022-07-011213681610.3390/app12136816APT-Attack Detection Based on Multi-Stage AutoencodersHelmut Neuschmied0Martin Winter1Branka Stojanović2Katharina Hofer-Schmitz3Josip Božić4Ulrike Kleb5DIGITAL—Institute for Information and Communication Technologies, Joanneum Research GesmbH, A-8010 Graz, AustriaDIGITAL—Institute for Information and Communication Technologies, Joanneum Research GesmbH, A-8010 Graz, AustriaDIGITAL—Institute for Information and Communication Technologies, Joanneum Research GesmbH, A-8010 Graz, AustriaDIGITAL—Institute for Information and Communication Technologies, Joanneum Research GesmbH, A-8010 Graz, AustriaDIGITAL—Institute for Information and Communication Technologies, Joanneum Research GesmbH, A-8010 Graz, AustriaPOLICIES—Institute for Economic and Innovation Research, Joanneum Research GesmbH, A-8010 Graz, AustriaIn the face of emerging technological achievements, cyber security remains a significant issue. Despite the new possibilities that arise with such development, these do not come without a drawback. Attackers make use of the new possibilities to take advantage of possible security defects in new systems. Advanced-persistent-threat (APT) attacks represent sophisticated attacks that are executed in multiple steps. In particular, network systems represent a common target for APT attacks where known or yet undiscovered vulnerabilities are exploited. For this reason, intrusion detection systems (IDS) are applied to identify malicious behavioural patterns in existing network datasets. In recent times, machine-learning (ML) algorithms are used to distinguish between benign and anomalous activity in such datasets. The application of such methods, especially autoencoders, has received attention for achieving good detection results for APT attacks. This paper builds on this fact and applies several autoencoder-based methods for the detection of such attack patterns in two datasets created by combining two publicly available benchmark datasets. In addition to that, statistical analysis is used to determine features to supplement the anomaly detection process. An anomaly detector is implemented and evaluated on a combination of both datasets, including two experiment instances–APT-attack detection in an independent test dataset and in a zero-day-attack test dataset. The conducted experiments provide promising results on the plausibility of features and the performance of applied algorithms. Finally, a discussion is provided with suggestions of improvements in the anomaly detector.https://www.mdpi.com/2076-3417/12/13/6816machine learningautoencoderanomaly detectionintrusion detectionstatistical analysis |
| spellingShingle | Helmut Neuschmied Martin Winter Branka Stojanović Katharina Hofer-Schmitz Josip Božić Ulrike Kleb APT-Attack Detection Based on Multi-Stage Autoencoders Applied Sciences machine learning autoencoder anomaly detection intrusion detection statistical analysis |
| title | APT-Attack Detection Based on Multi-Stage Autoencoders |
| title_full | APT-Attack Detection Based on Multi-Stage Autoencoders |
| title_fullStr | APT-Attack Detection Based on Multi-Stage Autoencoders |
| title_full_unstemmed | APT-Attack Detection Based on Multi-Stage Autoencoders |
| title_short | APT-Attack Detection Based on Multi-Stage Autoencoders |
| title_sort | apt attack detection based on multi stage autoencoders |
| topic | machine learning autoencoder anomaly detection intrusion detection statistical analysis |
| url | https://www.mdpi.com/2076-3417/12/13/6816 |
| work_keys_str_mv | AT helmutneuschmied aptattackdetectionbasedonmultistageautoencoders AT martinwinter aptattackdetectionbasedonmultistageautoencoders AT brankastojanovic aptattackdetectionbasedonmultistageautoencoders AT katharinahoferschmitz aptattackdetectionbasedonmultistageautoencoders AT josipbozic aptattackdetectionbasedonmultistageautoencoders AT ulrikekleb aptattackdetectionbasedonmultistageautoencoders |