The Influences of Feature Sets on the Detection of Advanced Persistent Threats

This paper investigates the influences of different statistical network traffic feature sets on detecting advanced persistent threats. The selection of suitable features for detecting targeted cyber attacks is crucial to achieving high performance and to address limited computational and storage cos...

Full description

Saved in:
Bibliographic Details
Published in:Electronics (Basel) 2021-03, Vol.10 (6), p.704
Main Authors: Hofer-Schmitz, Katharina, Kleb, Ulrike, Stojanović, Branka
Format: Article
Language:English
Subjects:
Communications traffic
Coronaviruses
Correlation analysis
COVID-19
Cybercrime
Cybersecurity
Data analysis
Data integrity
Datasets
Deep learning
Feature extraction
Financial institutions
Intellectual property
Machine learning
Malware
Outliers (statistics)
Personal information
Threats
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:This paper investigates the influences of different statistical network traffic feature sets on detecting advanced persistent threats. The selection of suitable features for detecting targeted cyber attacks is crucial to achieving high performance and to address limited computational and storage costs. The evaluation was performed on a semi-synthetic dataset, which combined the CICIDS2017 dataset and the Contagio malware dataset. The CICIDS2017 dataset is a benchmark dataset in the intrusion detection field and the Contagio malware dataset contains real advanced persistent threat (APT) attack traces. Several different combinations of datasets were used to increase variety in background data and contribute to the quality of results. For the feature extraction, the CICflowmeter tool was used. For the selection of suitable features, a correlation analysis including an in-depth feature investigation by boxplots is provided. Based on that, several suitable features were allocated into different feature sets. The influences of these feature sets on the detection capabilities were investigated in detail with the local outlier factor method. The focus was especially on attacks detected with different feature sets and the influences of the background on the detection capabilities with respect to the local outlier factor method. Based on the results, we could determine a superior feature set, which detected most of the malicious flows.
ISSN:2079-9292
2079-9292
DOI:10.3390/electronics10060704