A prospective approach to detect advanced persistent threats: Utilizing hybrid optimization technique
Advanced Persistent Threat (APT) attacks pose significant challenges for AI models in detecting and mitigating sophisticated and highly effective cyber threats. This research introduces a novel concept called Hybrid HHOSSA which is the grouping of Harris Hawk Optimization (HHO) and Sparrow Search Al...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Elsevier
2023-11-01
|
| Series: | Heliyon |
| Subjects: | |
| Online Access: | http://www.sciencedirect.com/science/article/pii/S2405844023085857 |
| _version_ | 1797429946305478656 |
|---|---|
| author | Indra Kumari Minho Lee |
| author_facet | Indra Kumari Minho Lee |
| author_sort | Indra Kumari |
| collection | DOAJ |
| description | Advanced Persistent Threat (APT) attacks pose significant challenges for AI models in detecting and mitigating sophisticated and highly effective cyber threats. This research introduces a novel concept called Hybrid HHOSSA which is the grouping of Harris Hawk Optimization (HHO) and Sparrow Search Algorithm (SSA) characteristics for optimizing the feature selection and data balancing in the context of APT detection. In addition, the light GBM as well as the weighted average Bi-LSTM are optimized by the proposed hybrid HHOSSA optimization. The HHOSSA-based attribute selection is used to choose the most important attributes from the provided dataset in the early step of the quasi-identifier detection. The HHOSSA-SMOTE algorithm effectively balances the unbalanced data, such as the lateral movements and the data exfiltration in the DAPT 2020 database, which further improves the classifier performance. The light GBM and the Bi-LSTM classifier hyperparameters are well attuned and classified by the HHOSSA optimization for the precise classification of the attacks. The outcome of both the optimized light GBM and the Bi-LSTM classifier generates the final prediction of the attacks existing in the network. According to the research findings, the HHOSSA-hybrid classifier achieves high accuracy in detecting attacks, with an accuracy rate of 94.468 %, a sensitivity of 94.650 %, and a specificity of 95.230 % with a K-fold value of 10. Also, the HHOSSA-hybrid classifier achieves the highest AUC percentage of 97.032, highlighting its exceptional performance in detecting APT attacks. |
| first_indexed | 2024-03-09T09:20:18Z |
| format | Article |
| id | doaj.art-e66a60e965504f99a207eb30a9bc95a7 |
| institution | Directory Open Access Journal |
| issn | 2405-8440 |
| language | English |
| last_indexed | 2024-03-09T09:20:18Z |
| publishDate | 2023-11-01 |
| publisher | Elsevier |
| record_format | Article |
| series | Heliyon |
| spelling | doaj.art-e66a60e965504f99a207eb30a9bc95a72023-12-02T07:02:02ZengElsevierHeliyon2405-84402023-11-01911e21377A prospective approach to detect advanced persistent threats: Utilizing hybrid optimization techniqueIndra Kumari0Minho Lee1Department of Machine Learning Data Research, Korea Institute of Science and Technology Information (KISTI), Daejeon, 34141, Republic of Korea; Department of Applied AI, University of Science and Technology (UST), Daejeon, 34113, Republic of KoreaDepartment of Machine Learning Data Research, Korea Institute of Science and Technology Information (KISTI), Daejeon, 34141, Republic of Korea; Department of Applied AI, University of Science and Technology (UST), Daejeon, 34113, Republic of Korea; Corresponding author. Department of Machine Learning Data Research, Korea Institute of Science and Technology Information (KISTI), Daejeon 34141, Republic of Korea.Advanced Persistent Threat (APT) attacks pose significant challenges for AI models in detecting and mitigating sophisticated and highly effective cyber threats. This research introduces a novel concept called Hybrid HHOSSA which is the grouping of Harris Hawk Optimization (HHO) and Sparrow Search Algorithm (SSA) characteristics for optimizing the feature selection and data balancing in the context of APT detection. In addition, the light GBM as well as the weighted average Bi-LSTM are optimized by the proposed hybrid HHOSSA optimization. The HHOSSA-based attribute selection is used to choose the most important attributes from the provided dataset in the early step of the quasi-identifier detection. The HHOSSA-SMOTE algorithm effectively balances the unbalanced data, such as the lateral movements and the data exfiltration in the DAPT 2020 database, which further improves the classifier performance. The light GBM and the Bi-LSTM classifier hyperparameters are well attuned and classified by the HHOSSA optimization for the precise classification of the attacks. The outcome of both the optimized light GBM and the Bi-LSTM classifier generates the final prediction of the attacks existing in the network. According to the research findings, the HHOSSA-hybrid classifier achieves high accuracy in detecting attacks, with an accuracy rate of 94.468 %, a sensitivity of 94.650 %, and a specificity of 95.230 % with a K-fold value of 10. Also, the HHOSSA-hybrid classifier achieves the highest AUC percentage of 97.032, highlighting its exceptional performance in detecting APT attacks.http://www.sciencedirect.com/science/article/pii/S2405844023085857Advanced persistent threatsHarris Hawk optimizationSparrow search algorithmLight GBMBi-LSTM classifiers |
| spellingShingle | Indra Kumari Minho Lee A prospective approach to detect advanced persistent threats: Utilizing hybrid optimization technique Heliyon Advanced persistent threats Harris Hawk optimization Sparrow search algorithm Light GBM Bi-LSTM classifiers |
| title | A prospective approach to detect advanced persistent threats: Utilizing hybrid optimization technique |
| title_full | A prospective approach to detect advanced persistent threats: Utilizing hybrid optimization technique |
| title_fullStr | A prospective approach to detect advanced persistent threats: Utilizing hybrid optimization technique |
| title_full_unstemmed | A prospective approach to detect advanced persistent threats: Utilizing hybrid optimization technique |
| title_short | A prospective approach to detect advanced persistent threats: Utilizing hybrid optimization technique |
| title_sort | prospective approach to detect advanced persistent threats utilizing hybrid optimization technique |
| topic | Advanced persistent threats Harris Hawk optimization Sparrow search algorithm Light GBM Bi-LSTM classifiers |
| url | http://www.sciencedirect.com/science/article/pii/S2405844023085857 |
| work_keys_str_mv | AT indrakumari aprospectiveapproachtodetectadvancedpersistentthreatsutilizinghybridoptimizationtechnique AT minholee aprospectiveapproachtodetectadvancedpersistentthreatsutilizinghybridoptimizationtechnique AT indrakumari prospectiveapproachtodetectadvancedpersistentthreatsutilizinghybridoptimizationtechnique AT minholee prospectiveapproachtodetectadvancedpersistentthreatsutilizinghybridoptimizationtechnique |