# APT-Attack Detection Based on Multi-Stage Autoencoders
## 7 Conclusions and Future Work  
In this paper, the analysed datasets relate to multiple independent application scenarios, and also include APT-attack traces (derived from Contagio and merged with CIICS2017). For example, the evaluation of the combined CICIDS2017/Contagio dataset shows that variational autoencoder approaches (VAE, VAE-Prob) achieve better results than normal autoencoders. However, all the inspected algorithms exhibit satisfying results, especially with regard to the practically relevant TP and TN rates. On the other hand, new methods in the scenario with \"completely unknown\", i.e., zero-day, attacks exhibit similar TN rates, but with lower TP rates. Similar results are also observed when applying the reference approach of unrealistic scenarios from classical ML. The reason for this, therefore, is the increased dataset complexity, which does not represent a problem of the procedure itself. For both datasets, it can be concluded that the running time of the pure autoencoder methods is slower than that of the variational counterpart. The best performance is achieved with VAE-Prob, which is independent of the selected threshold value. In addition, the two-stage approach exploits these advantages without losses in the runtime. Nevertheless, it can be assumed that a further adaptation of threshold values at runtime would improve the results. This is especially the case with changing boundary conditions, which should be checked on a regular basis.  
A major conclusion of the work proposed in this paper is that unsupervised machine-learning methods can be successfully used to detect advanced cyberattacks targeting network infrastructures. Even in a case of a new attack type with a pattern unknown during the training and validation phases, trained models could be used successfully without a need for re-training. Beneficial improvements in this case would include developing methods for a threshold adaptation.  
Given all the results and observations, our future work will include the automation of threshold selection and consider practical applications. It will also include the testing of simulation environments and deriving new and comprehensive datasets for APT-attack detection evaluation.  
Conceptualization, B.S., K.H.-S., H.N. and M.W.; methodology, B.S., K.H.-S., H.N., M.W. and U.K.; software, H.N., M.W., K.H.-S., J.B. and U.K.; validation, H.N., M.W. and B.S.; investigation, H.N., M.W., B.S., K.H.-S., J.B. and U.K.; data curation, K.H.-S., J.B. and U.K.; writing--original draft preparation, H.N., M.W., B.S., J.B. and U.K.; writing--review and editing, B.S., H.N. and M.W.; visualisation, J.B., H.N., M.W. and U.K.; project administration, K.H.-S. and B.S. All authors have read and agreed to the published version of the manuscript.  
This work was funded by the Austrian Federal Ministry of Climate Action, Environment, Energy, Mobility, Innovation and Technology (BMK) under the project SecFIT (Design and Runtime Security for Internet of Things).  
Not applicable.  
We would like to express our gratitude to [PERSON] (Fraunhofer AISEC) for his constructive project review and valuable insights.  
The authors declare no conflict of interest. The funders had no role in the design of the study; in the collection, analysis, or interpretation of data; in the writing of the manuscript, or in the decision to publish the results.