Detecting Advanced Persistent Threats on a Network Using Machine Learning

Advanced Persistent Threats (APTs) present a growing concern for both government and private institutions globally. Well-funded criminal organizations employ advanced technologies to exploit vulnerabilities, often launching targeted attacks over prolonged periods. Detection and mitigation of APT attacks are challenging due to their sophisticated nature, necessitating the adoption of novel techniques by security practitioners. This paper proposes a machine learning approach leveraging Long Short-Term Memory (LSTM) models to detect anomalies in network traffic indicative of APT activity. Our focus lies in building a baseline model that learns users' daily activities over the network, enabling it to identify deviations from normal behavior. We utilize the Operationally Transparent Cyber (OPTC) dataset by the Defense Advanced Research Projects Agency (DARPA) for experimentation, addressing the challenge of data scarcity in APT research. We conducted three experiments, employing different LSTM architectures (Stateless LSTM, Bidirectional LSTM, and Stateful LSTM Model) to assess their performance in APT detection. Each model undergoes the same preprocessing steps, and results are evaluated based on their ability to distinguish between benign and malicious traffic. Results show promising performance, with the Stateful LSTM Model outperforming others in identifying APT-related anomalies.