These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Advanced Persistent Threats (APTs) represent a sophisticated and persistent
cy-bersecurity challenge, characterized by stealthy, multi-phase, and targeted
attacks aimed at compromising information systems over an extended period.
Develop-ing an effective Intrusion Detection System (IDS) capable of detecting
APTs at different phases relies on selecting network traffic features. However,
not all of these features are directly related to the phases of APTs. Some
network traffic features may be unrelated or have limited relevance to
identifying malicious ac-tivity. Therefore, it is important to carefully select
and analyze the most relevant features to improve the IDS performance. This
work proposes a feature selection and classification model that integrates two
prominent machine learning algo-rithms: SHapley Additive exPlanations (SHAP)
and Extreme Gradient Boosting (XGBoost). The aim is to develop lightweight IDS
based on a selected minimum number of influential features for detecting APTs
at various phases. The pro-posed method also specifies the relevant features
for each phase of APTs inde-pendently. Extensive experimental results on the
SCVIC-APT-2021 dataset indi-cated that our proposed approach has improved
performance compared to other standard techniques. Specifically, both the
macro-average F1-score and recall reached 94% and 93 %, respectively, while
reducing the complexity of the detec-tion model by selecting only 12 features
out of 77.