A novel approach for predicting the spread of APT malware in the network

Advanced Persistent Threat (APT) attack is one of the most dangerous cyber-attack techniques nowadays. Therefore, the issue of detecting and predicting the spread of APT malware in the network is a very urgent issue to help the process of preventing this attack effectively. In this paper, we propose a new approach that is capable of predicting the spread of APT malware in the network based on the APT's own behaviors. Accordingly, to predict the spread of APT malicious code in the system, we propose to use a combination of two single Susceptible‐Infected‐Recovered (SIR) models. Specifically, the first SIR model was built to predict the spread of APT malicious code to devices and computers within the organization. These devices and computers are often used by APT malicious code as a basis to escalate privileges to devices or computers containing important and sensitive information of the organization. The second SIR model has the function of predicting the spread of APT malware to a group of computers containing sensitive information or potentially causing high risks to the organization. The two SIR models will provide information about infections between computer groups in the system to help accurately predict the spread of APT malware in the system. The proposal to combine two SIR models in the article is a new proposal based on the behavior of APT malware in practice. By combining two SIR models, the proposal in this article has opened up a new approach for a number of problems predicting the spread in the internet such as malicious code in wireless sensor networks or malicious information on the social network.