Advanced Persistent Threat Detection and Mitigation Using Machine Learning Model  

作　　者：U.Sakthivelu C.N.S.Vinoth Kumar 

机构地区：[1]Department of Networking and Communications,College of Engineering and Technology(CET),SRM Institute of Science and Technology,Kattankulathur,Chennai,603203,India

出　　处：《Intelligent Automation & Soft Computing》2023年第6期3691-3707,共17页智能自动化与软计算（英文）

摘　　要：The detection of cyber threats has recently been a crucial research domain as the internet and data drive people’s livelihood.Several cyber-attacks lead to the compromise of data security.The proposed system offers complete data protection from Advanced Persistent Threat(APT)attacks with attack detection and defence mechanisms.The modified lateral movement detection algorithm detects the APT attacks,while the defence is achieved by the Dynamic Deception system that makes use of the belief update algorithm.Before termination,every cyber-attack undergoes multiple stages,with the most prominent stage being Lateral Movement(LM).The LM uses a Remote Desktop protocol(RDP)technique to authenticate the unauthorised host leaving footprints on the network and host logs.An anomaly-based approach leveraging the RDP event logs on Windows is used for detecting the evidence of LM.After extracting various feature sets from the logs,the RDP sessions are classified using machine-learning techniques with high recall and precision.It is found that the AdaBoost classifier offers better accuracy,precision,F1 score and recall recording 99.9%,99.9%,0.99 and 0.98%.Further,a dynamic deception process is used as a defence mechanism to mitigateAPTattacks.A hybrid encryption communication,dynamic(Internet Protocol)IP address generation,timing selection and policy allocation are established based on mathematical models.A belief update algorithm controls the defender’s action.The performance of the proposed system is compared with the state-of-the-art models.

关 键 词：Advanced persistent threats lateral movement detection dynamic deception remote desktop protocol Internet Protocol attack detection 

分 类 号：TP181[自动化与计算机技术—控制理论与控制工程]