## 3 Machine Learning
### Approaches Used for APT Detection  
The volume of data generated by information systems has increased in recent years. This growth has made malware and network attacks more difficult to detect. However, several approaches have been proposed to solve this problem, such as dynamic analysis [59], context-based [60], independent access [61], contextual information [62], and information flow tracking [63]. These data must be analysed in the shortest possible time to identify an attack. Consequently, researchers have begun to use machine learning techniques to improve the rate of true positives in detecting APT attacks [64]. Some proposed approaches are detailed below. A novel machine learning-based system called MLAPT was presented in [6]. This model was detected APT attacks through early alerts that are analysed by ML algorithms. These alerts have been created from a correlation framework between several detection modules. MLAPT is based on the analysis of a six-phase APT life cycle: (1) Intelligence Gathering, (2) Point of entry, (3) C&C Communication, (4) Lateral Movement, (5) Asset/Data Discovery, and (6) Data Exfiltration. The MLAPT framework works in three phases:  
* Threat detection: The network traffic is scanned by eight detection modules to find techniques used by APT. The output of this phase consists of alerts, known as events. * Alert correlation: The events generated by detection modules are correlated, and the output can be two types of alerts. * Attack prediction: A machine learning-based prediction module is used to detect APT techniques. A novel distributed framework architecture for APT detection (DFA-AD) is described in [65]. This framework classifies events in a distributed environment and correlation between them to detect techniques used by APT. Intrusion detection is realised in a distributed environment on the trusted platform module (TPM). DFA-AD has been designed in three phases:* Network traffic, traffic flow is collected, processed, and analysed by a method of recognition using machine learning algorithms. * Correlation event, through specific rules given by an administrator, the events generated in the previous phase are collected to be evaluated. * Voting service, the previous information are analysed, and the alert is generated if an APT attack is detected. Fractal-based anomaly classification mechanism is presented in [66]. This method has used \(k\)-NN and correlation fractal dimension (FD) as anomaly classification algorithms to test the dataset and comparison of the results. In the first step, two datasets with normal network traffic and APT attack traffic packages were combined. Then, vector characteristics were extracted through the analysis of the TCP (Transmission Control Protocol) session data. Next, the dataset noise has been removed, and the result dataset will be used on the anomaly classification algorithm to detect an attack. Finally, the authors demonstrated that the algorithm based on the Euclidean dimension is less effective than the algorithm based on the fractal dimension, giving better results. An APT detection system based on the big data architecture process was proposed in [67]. This model used \(k\)-NN algorithms with big data about network data, system logs, and security information. This system was divided into four steps:  
* APT system architecture: Network data and information system was collected to be analysed. * Big data processing technology: A Hadoop cluster was used to improve the analysis of an APT attack. * APT analysis technology: The detection of malicious attack was detected from vulnerabilities and suspicious connections with anomalous behaviour. * APT detection algorithm: This method used the tool Mahout because it can process big data and \(k\)-NN algorithm can be used for the detection. This model was divided into four phases: retrieve, reuse, revise, and retain. An anomaly-based approach for the detection of malicious RDP (remote desktop protocol) sessions was detailed in [5].