## 2 Methods  
### Materials and Experimental Setup  
The analysis of APT network attack packets is not new technology, but it has become an essential part of network administrators and information security and is used to analyze regular activities. In the past, it usually applied to the analysis of network behavior or debugging of the network environment. In the current network milieu, where information security incidents are frequent, this investigation has become regular and essential. Side recording of network packets from a target host can provide information about events that enables even more information to be obtained through analysis. Therefore, while facing current popular APT attacks hidden behind communication behavior, and even in the communication content, it is possible to obtain key information by using network packet analysis technology. In this study, a comparison has been made between the correct rate of APT network attack detection using the NSL-KDD data sets and PCA dimensionality reduction technology and four machine learning classification algorithms: SVM, naive Bayes, decision tree, and the multi-layer perceptron neural network (MLP). Most relevant work has been done using the \"WEKA Spreadsheet to ARFF\" service to convert the NSL-KDD data set format from files with the csv extension to ARFF extension format (including \"training data set (KDDTrain+)\" and \"test data set (KDDTest+)\" ([[https://github.com/jmnwong/NSL-KDD-Dataset](https://github.com/jmnwong/NSL-KDD-Dataset)]([https://github.com/jmnwong/NSL-KDD-Dataset](https://github.com/jmnwong/NSL-KDD-Dataset))) is the reference URL. Because the data has different ranges, preprocessing needed to be done to round up all the features. Two type classifiers were used, normal, and anomaly. The PCA algorithm was then used to reduce the size of the classified data set. Finally, the pre-processed training and test data sets were grouped and tested, and experiments with the four classification algorithms were carried out. These were SVM [21; 22; 23], naive Bayes [24], decision tree [25], and MLP and they were used to train and test the data and compare and analyze the results. Each record had data with 41 different feature attributes presenting the content of the network packets. There were four categories of anomalous attack DoS, Probe, R2L, and U2R and the definitions are shown in Table 1.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Type of Anomaly** & **Definition** & **Related Features** \\ \hline DoS & Distributed denial-of-service (DoS) exhausts the target resources, making it impossible to process legitimate requests. & \(\bullet\) & Original bit \\ \hline Probe & The goal of surveillance and other probe attacks is to gather related information about remote victims. & \(\bullet\) & Continuous connection time \\ \hline R2L & Unauthorized remote machine connection, the attacker invades the remote machine and gains local access to the target system. & \(\bullet\) & Internet rights \\ \hline U2R & Unauthorized access as a local user (admin/root) administrative privileges. The attacker logs into the target system using a regular account and attempts to obtain administrator and root privileges by exploiting certain system vulnerabilities. & \(\bullet\) & Number of file creations \\ \hline \hline \end{tabular}
\end{table}
Table 1: Four classified categories of anomalous attack