A Combinational Model-Based APT Attack Detection Approach

In the context of a world increasingly reliant on digital technology, Advanced Persistent Threats (APT) pose a significant challenge to global cybersecurity. To address this issue, this paper introduces a novel approach called BiLSTM-Attention-GCN (BiLAG), an advanced model combining Bidirectional Long Short-Term Memory (BiLSTM) networks, Attention mechanisms, and Graph Convolutional Networks (GCN). The goal of BiLAG is to provide an effective and accurate method for detecting APT. BiLSTM is employed to capture temporal features related to event sequences, enabling the detection of anomalies over time. The Attention mechanism focuses on the most critical aspects of the dataset, allowing the model to identify hidden signals that indicate potential attacks. Lastly, GCN is utilized to explore complex relationships among network entities, enhancing APT detection by constructing a detailed and precise relational graph. Experimental results demonstrate that BiLAG achieves an accuracy of 99%, with high recall and significantly reduced false positive rates.