Score Sketch: An Efficient and Reversible Sketch for Advanced Persistent Threat Detection

In recent years, Advanced Persistent Threat (APT) attacks have made network security problems particularly prominent. APT attacks are characterised by high persistence and low-cardinality. Given that sketch is a compact probabilistic data structure with the advantages of fast processing speed, low memory overhead, and efficient processing of large-scale data, this paper introduces for the first time a Sketch-based APT detection framework for identifying persistent and low-cardinality flows, named Score Sketch. Meanwhile, Score Sketch is validated and evaluated based on real network traffic traces on CPU. Experimental results show that Score Sketch has higher accuracy and performance in identifying persistent and low-cardinality flows. Compared with typical schemes, the proposed Score Sketch reduces the ARE by an average of 22x and 28x, improves precision by an average of 1.69x and 1.31x, recall by an average of 1.53x and 1.18x, F1 Score by an average of 1.63x and 1.24x, and throughput by an average of 4.93x and 1.34x.