ML-based intrusion detection system for precise APT cyber-clustering

Abstract

As more and more documents are converted from hard copies to digital formats and move to cloud storage, securing data access has become a critical and emergent security concern. Without a doubt, intrusion detection system (IDS) has become the primary defense mechanism for governments and enterprises to identify network attacks. However, the emergence of Advanced Persistent Threat (APT) has brought heightened challenges for an IDS, since malicious hackers can deploy various attacks to penetrate information systems invisibly over extended periods of time. Thus, the authors aim to design a High Discrimination APT Intrusion Detection System (HDAPT-IDS); consisting of Cyber Clustering Module (CCM) and Clustering Analysis Module (CAM). CCM conducts a preliminary classification of traffic packets and utilizes the random forest algorithm to predict the main-class, while CAM selects the applicable Deep Neural Network (DNN) based on the prediction results of CCM to derive the sub-class of traffic packets as the final result. Aside from laying out a high detection rate, HDAPT-IDS can effectively reduce the number of categories during classification to achieve better performance.