A Novel Deep Learning Stack for APT Detection

Applied Sciences

Tero Bodström¹  Timo Hämäläinen¹ 

[1] Faculty of Information Technology, University of Jyväskylä, 40014 Jyväskylä, Finland;

关键词: Advanced Persistent Thread (APT);    Deep Learning (DL);    network anomaly detection;   

DOI  :  10.3390/app9061055

来源: DOAJ

【 摘 要 】

We present a novel Deep Learning (DL) stack for detecting Advanced Persistent threat (APT) attacks. This model is based on a theoretical approach where an APT is observed as a multi-vector multi-stage attack with a continuous strategic campaign. To capture these attacks, the entire network flow and particularly raw data must be used as an input for the detection process. By combining different types of tailored DL-methods, it is possible to capture certain types of anomalies and behaviour. Our method essentially breaks down a bigger problem into smaller tasks, tries to solve these sequentially and finally returns a conclusive result. This concept paper outlines, for example, the problems and possible solutions for the tasks. Additionally, we describe how we will be developing, implementing and testing the method in the near future.

【 授权许可】

Unknown