# APT-Attack Detection Based on Multi-Stage Autoencoders
## 4 Proposed Methodology
### Anomaly Detection with Autoencoders  
As described in previous sections, the conducted experiments were tested on a combination of the two datasets. The combined result represents a more complex test dataset, which is used for validation and testing. In addition, the test dataset is further used for the additional testing of algorithms on previously unknown attack types. For the conducted tests, the following algorithms were applied:  
* Standard autoencoder (AE): This neural network comes with multiple, dense layers that are trained with benign data. It does not consider attack data during this process. * Autoencoder based on convolutional networks (AE-CNN): This comes in a combination of one-dimensional convolutional and dense connected layers. In addition, this system is trained with only benign data. * Variational autoencoder (VAE): This sampling-based autoencoder proposed by [PERSON] and [PERSON] [40] consists of dense connected layers that are trained with only benign data. * Variational autoencoder using reconstruction probability (VAE-Prob): This probability-based autoencoder consists of dense connected layers. In addition, it is trained with only benign data. * One-class support vector machine (OCSVM): This ML model represents the \"gold standard\" in classic ML. Similar to the networks above, it is trained only with benign data. * Combination of the standard autoencoder and the variational autoencoder (AE+VAE): This two-stage approach, as presented in the previous work in [14], combines both models, which underlying idea is depicted in Figure 3. In a first step--referred to as the pre-processing or filtering step--a fast anomaly detector filters out data which, with a very high probability, does not belong to any anomaly. The remaining data is then evaluated by a second, more specific, anomaly detector that provides a more accurate decision. Figure 2: Boxplot comparison of statistical distributions for independent and zero-day attacks. Autoencoder with labelled data (AEC): this autoencoder is used together with the custom loss function to achieve the best DL-based results. The \"custom\" loss function (used by AE-Custom) takes into account the anomaly data for the calculation of the reconstruction error \(err_{rec}\) as follows:  
\[err_{rec}= \frac{n_{benign}}{n}\tanh(mse(y_{benign},y_{pred}))+ \tag{1}\] \[\frac{n_{anomaly}}{n}(1-\tanh(mse(y_{anomaly},y_{pred})))\]  
where:  
\(err_{rec}=\) reconstruction error;  
\(n=\) number feature vectors;  
\(n_{benign}=\) number of benign vectors;  
\(n_{anomaly}=\) number of anomaly vectors;  
\(y_{benign}=\) benign feature vectors;  
\(y_{anomaly}=\) anomaly feature vectors;  
\(y_{pred}=\) predicted feature vectors;  
\(mse=\) mean square error function. However, it should be mentioned that this autoencoder serves only for comparison purposes, since it represents a supervised method. In this way, it provides insights regarding the complexity of datasets. Hyper-Parameter Optimisation  
The implementation of neural-network models for different autoencoders is realised with Talos [41]. This framework is used for the optimisation of hyperparameters. This means that Talos enables a random parameter search by applying a correlation method. The corresponding performance metric for model optimisation represents the area under the ROC curve (AUC). The parameter set that was selected for optimisation can be observed in Table 3, as shown in the previous work in [14]. In this work, most of the parameters of interest are defined with the Keras framework [42]. In this DL framework, the \"layer reduction\" parameter defines how the number of neurons changes after each layer. This means that the number of encoder neurons is reduced or decoder neurons is increased (value: True ). In addition, the number of neurons can remain unchanged (value: False). Some of the parameters are applied only for  
Figure 3: Two-stage anomaly detection with autoencoders. some autoencoder variants. For example, the \"number of convolutional layers\" is only used in AE-CNN.