The APT family classification system based on APT call sequences and attention mechanism

Advanced persistent threats (APT) pose a major cybersecurity concern due to their covert nature and targeted attacks on enterprises, industries, and national infrastructures. Orchestrated by well-organised hacker groups, these threats leverage sophisticated malware, which makes detection and source tracing challenging. However, characteristic patterns within the malware used by each hacker group allow for classification and analysis. In this study, we present an innovative APT classification system that leverages the temporal dependencies of API call sequences through a hybrid deep learning model. By integrating a one-dimensional convolutional neural network (CNN) with a bidirectional long short-term memory (BiLSTM) network, enhanced with an attention mechanism, our system effectively captures the nuanced behaviours of malware. This model allows for a refined understanding of APT malware, offering both high accuracy and practical utility. The system is tested on a dataset of 12 different malware families, and the results show high accuracy and practical utility.