A New Realistic Benchmark for Advanced Persistent Threats in Network Traffic
Jinxin Liu, Yu Shen, Murat Şimşek, Burak Kantarcı, Hussein T. Mouftah, Mehran Bagheri, Petar Djukic
Abstract
In order to define a benchmark for Machine Learning (ML)-based Advanced Persistent Threat (APT) detection in the network traffic, this letter presents SCVIC-APT-2021, a new dataset that can realistically represent the contemporary network architecture and APT characteristics. Following upon this, an ML-based Attack Centric Method (ACM) is introduced to evaluate the APT detection performance on the generated dataset. Furthermore, ACM has been shown to outperform the baseline approaches with a maximum macro average F1 score of 82.27% corresponding to 9.4% improvement with respect to the baseline performance.
Topics & Concepts
Benchmark (surveying)Baseline (sea)Computer scienceMacroArtificial intelligenceMachine learningProgramming languageGeographyGeologyGeodesyOceanographyNetwork Security and Intrusion DetectionAdvanced Malware Detection TechniquesAnomaly Detection Techniques and Applications