# APT-Attack Detection Based on Multi-Stage Autoencoders
###### Abstract  
In the face of emerging technological achievements, cyber security remains a significant issue. Despite the new possibilities that arise with such development, these do not come without a drawback. Attackers make use of the new possibilities to take advantage of possible security defects in new systems. Advanced-persistent-threat (APT) attacks represent sophisticated attacks that are executed in multiple steps. In particular, network systems represent a common target for APT attacks where known or yet undiscovered vulnerabilities are exploited. For this reason, intrusion detection systems (IDS) are applied to identify malicious behavioural patterns in existing network datasets. In recent times, machine-learning (ML) algorithms are used to distinguish between benign and anomalous activity in such datasets. The application of such methods, especially autoencoders, has received attention for achieving good detection results for APT attacks. This paper builds on this fact and applies several autoencoder-based methods for the detection of such attack patterns in two datasets created by combining two publicly available benchmark datasets. In addition to that, statistical analysis is used to determine features to supplement the anomaly detection process. An anomaly detector is implemented and evaluated on a combination of both datasets, including two experiment instances-APT-attack detection in an independent test dataset and in a zero-day-attack test dataset. The conducted experiments provide promising results on the plausibility of features and the performance of applied algorithms. Finally, a discussion is provided with suggestions of improvements in the anomaly detector. machine learning; autoencoder; anomaly detection; intrusion detection; statistical analysis +
Footnote †: journal: Applied Sciences  
1 DIGITAL--Institute for Information and Communication Technologies, Joanneum Research GesmbH, A-8010 Graz, Austria; [EMAIL_ADDRESS] (H.N. ); [EMAIL_ADDRESS] (M.W. ); [EMAIL_ADDRESS] (B.S. ); [EMAIL_ADDRESS] (K.H.-S.)  
1 DIGITAL--Institute for Information and Communication Technologies, Joanneum Research GesmbH, A-8010 Graz, Austria; [EMAIL_ADDRESS] (H.N. ); [EMAIL_ADDRESS] (M.W. ); [EMAIL_ADDRESS] (B.S. ); [EMAIL_ADDRESS] (K.H.-S.)  
1 DIGITAL--Institute for Information and Communication Technologies, Joanneum Research GesmbH, A-8010 Graz, Austria; [EMAIL_ADDRESS] (H.N. ); [EMAIL_ADDRESS] (M.W. ); [EMAIL_ADDRESS] (B.S. ); [EMAIL_ADDRESS] (B.S. ); [EMAIL_ADDRESS] (K.H.-S.)  
1 DIGITAL--Institute for Information and Communication Technologies, Joanneum Research GesmbH, A-8010 Graz, Austria; [EMAIL_ADDRESS] (H.N. ); [EMAIL_ADDRESS] (M.W. ); [EMAIL_ADDRESS] (B.S. ); [EMAIL_ADDRESS] (K.H.-S.)  
1 DIGITAL--Institute for Information and Communication Technologies, Joanneum Research GesmbH, A-8010 Graz, Austria; [EMAIL_ADDRESS] (H.N. ); [EMAIL_ADDRESS] (M.W. ); [EMAIL_ADDRESS] (B.S. ); [EMAIL_ADDRESS] (K.H.-S.)  
1 DIGITAL--Institute for Information and Communication Technologies, Joanneum Research GesmbH, A-8010 Graz, Austria; helmut.neuschmied@jocan be used for further actions in the aftermath. For this reason, the identification of the initial step remains the most important challenge in intrusion detection [1]. Inspired by existing ML and deep-learning (DL) methods, neural networks--for example, autoencoders--are applied to anomaly detection. Autoencoders are a special type of unsupervised learning technique that can be used to derive and learn features and packet classification [2]. They are a special type of multi-layer neural network performing non-linear dimensionality reduction in the data. Given a large amount of benign data, they can be trained to reconstruct input data as closely as possible by minimizing the reconstruction error on the network's output. In turn, the reduced representation in the so-called bottleneck layer make the autoencoders useful for outlier or anomaly detection [3].