# A Novel Method for Detecting Advanced Persistent Threat Attack Based on Belief Rule Base
## 3 The BRB-Based APT Detection Model
### APT Detection Method Based on BRB  
#### 3.2.1 APT Attack Feature Selection  
First, the key features that can describe the APT attack are selected as the antecedent attributes of the BRB detection model.  
1. **Traced path.** Attackers focus on high-value objects such as databases, servers, and significant hosts, which is one of features of APT. High-value objects can be represented by their location in the network if it is connected to the network. When the location in the network is determined, the value of the corresponding object is also determined. For example, the database is very significant because it stores essential data, and it can be represented on the network as a client data server, a backup server, or a data center server in the intranet. High-value objects need to be closely monitored to prevent them from being destroyed or stolen by attackers, so it is important to identify the source of access. Direct access is easy to detect, so APT attacks are usually hidden in normal access traffic to avoid detection. However, when tracing the source of traffic, anomalous traffic and normal traffic have a different access source somewhere, shown as Figure 1. Then, the traced path can be used as one of the features to detect APT. The location represented in the traffic is the IP address, which is the data to be collected. 2. **Traffic rate.** Just the traced path is not enough. The IP address can also be forged. Other features need to be used as a supplement to determine APT. The higher the rate of attack traffic in the normal traffic, the easier it is to detect. Since frequent anomalies can easily be assumed that an attack has occurred. The traffic from APT attacks usually represents only a small fraction of normal traffic to reduce the chances of detection. The rate of anomalous traffic to total traffic for a time period can be used as a feature to detect APT. When the rate is small, it means that the traffic is likely to be an APT attack. The rate can be calculated by counting traffic packets. 3. **Average time interval.** APT attacks will last a long time as a way to reduce the correlation between attack traffic. APT attack traffic appears to be random, but it has a long average time interval in a long period of time. Therefore, the average time interval of traffic can be used as a feature to detect APT. The average time interval can be calculated by the time recorded when the traffic packet is captured. 4. **Average transferred bytes.** The large number of transferred bytes should also be monitored. However, the alarm is not normally triggered when the number of bytes transferred is too small. APT can evade detection by transferring a small number of bytes at a time, splitting malicious code into many small pieces to avoid detection, and finally, reassembling it at the right time to achieve the purpose of attack, which is one of the common tactics of APT attackers. The average transferred bytes is one of features of APT, which can be calculated by traffic packets. Based on above descriptions, four features are determined, including path, traffic rate, average time interval, and average transferred bytes, which can be extracted from the IP packets by experts. The reference values of attributes can be set, as shown in Table 1.  
Figure 1: Traced path.  
The numerical value of reference value needs to be determined according to the actual network. \"Low\" corresponds to the smallest numeric value. \"High\" corresponds to the largest numeric value. \"Medium\" can be determined by expert knowledge.