# A Novel Deep Learning Stack for APT Detection
## 4 Deep Learning Detection Stack
### Known Attacks  
The purpose of the first layer is to detect known attacks from data flow, save them to database with timestamp and finally remove the detected data from the flow. The rest of the data flow is pushed to the second detection layer, according to Figure 1. The detection accuracy is not 100 percent, thus even when the known attacks are removed, there is a possibility for existing traces of known attacks in the rest of the data.  
The first layer includes multiple neural networks, which are trained regularly. That is, instead of using one neural network that is re-trained and updated, we add new neural networks to the stack, which are trained with new outlier detections. This method is used to avoid overfitting.  
For testing and optimisation purposes, we execute tests with semi-supervised (SDL) and unsupervised (UDL) Deep Learning methods in this layer. Neural networks are trained with data from known attacks and, in the case the DL detects a known attack, it drops data from flow. For example, an Autoencoder (AE) that consists of deep layers can be trained only with known attacks, thus, when it detects a known attack, it reconstructs the observation correctly. In other words, all data that cause enough reconstruction error are passed to the next layer.  
Here is a more detailed example how the first and second detection layers are re-trained and kept up to date. We use the following syntax: xNy, where x represents the assigned AE (1 for known attacks and 2 for normal traffic) and y is the interval number that increases from 1 to \(n\). To clarify, when considering the first and second layers, there are count of y unique AEs with their own input and output layers. That is, the first and second detection layers, as described in Figure 1, do not include only one AE.  
First, the training interval is set, 24 h in this example. That is, a new neural network is trained every 24 h. The neural network in the first layer 1N1 is trained with available data of known attacks and the second layer's neural network 2N1 with available normal traffic data. The data input from the first day is tested with 1N1 and 2N1 for anomalies. The first and second layer networks for the second day are trained with the data processed on the first day, including the identified attacks and updated normal traffic. The data input from the second day is processed by 1N1 and 1N2 for known attacks as well as 2N1 and 2N2 for normal traffic. The networks for the third day are constructed in the same fashion resulting in three networks in the first layer and three networks in the second layer for detecting known attacks and normal traffic, respectively. In other words, each layer after the first one is trained with the detections only from the previous layer.  
With this architecture, the number of neural networks increases depending on the training interval. It can be set for a day, week, month or some suitable value. For example, when limiting the maximum time of operation of the whole system to one year and the training interval is one day, the number of neural networks would be 365 in the first and second layers. For time complexity, this means that there would be 365 standard time operations in each layer, which could exclude real-time detection. However, it can be assumed that detection process would not take too long time. With the described architecture, we can minimise the possibility for overfitting, which is important for neural networks to be able to detect anomalies.