A novel framework for APT attack detection based on network traffic | ||
| International Journal of Nonlinear Analysis and Applications | ||
| مقاله 235، دوره 13، شماره 2، مهر 2022، صفحه 2933-2945 اصل مقاله (1.58 M) | ||
| نوع مقاله: Research Paper | ||
| شناسه دیجیتال (DOI): 10.22075/ijnaa.2022.26981.3468 | ||
| نویسندگان | ||
| Bui Van Cong* 1؛ Nguyen Quoc Thanh2؛ Nguyen Duy Phuong3 | ||
| 1Department of Information Technology, University of Economics and Technical Industries, Ha Noi, Vietnam | ||
| 2Information Technology Department, LienVietPostBank, Ha Noi, Vietnam | ||
| 3Department of Information Technology, Posts and Telecommunications Institute of Technology, Ha Noi, Vietnam | ||
| چکیده | ||
| APT (Advanced Persistent Threat) attack is a dangerous, targeted attack form with clear targets. APT attack campaigns have huge consequences. Therefore, the problem of researching and developing the APT attack detection solution is very urgent and necessary nowadays. On the other hand, no matter how advanced the APT attack, it has clear processes and lifecycles. Taking advantage of this point, security experts recommend that could develop APT attack detection solutions for each of their life cycles and processes. In APT attacks, hackers often use phishing techniques to perform attacks and steal data. If this attack and phishing phase is detected, the entire APT attack campaign will be crash. Therefore, it is necessary to research and deploy technology and solutions that could detect early the APT attack when it is in the stages of attacking and stealing data. This paper proposes an APT attack detection framework based on the Network traffic analysis technique using open-source tools and deep learning models. This research focuses on analyzing Network traffic into different components, then finds ways to extract abnormal behaviors on those components, and finally uses deep learning algorithms to classify Network traffic based on the extracted abnormal behaviors. The abnormal behavior analysis process is presented in detail in section III.A of the paper. The APT attack detection method based on Network traffic is presented in section III.B of this paper. Finally, the experimental process of the proposal is performed in section IV of the paper | ||
| کلیدواژهها | ||
| APT؛ APT detection؛ network traffic؛ LSTM؛ abnormal behavior analysis | ||
| مراجع | ||
|
| ||
|
آمار تعداد مشاهده مقاله: 45,287 تعداد دریافت فایل اصل مقاله: 53,513 |
||
| تعداد نشریات | 22 |
| تعداد شمارهها | 721 |
| تعداد مقالات | 10,359 |
| تعداد مشاهده مقاله | 72,761,951 |
| تعداد دریافت فایل اصل مقاله | 64,423,371 |