Using Inference and Graph Convolutional Networks for APT Attack Detection

In this article, we propose an IG model for detecting APT attacks based on network traffic. The model consists of two main layers: the I layer -Inference layer constructs an IP information profile through clustering and connecting network flows generated from the same IP. The final layer, G- Graph Convolutional Networks (GCN), plays a role in analyzing and reconstructing IP features based on behavior extraction from the IP information profile. The APT attack detection method based on network traffic using the IG model technique is a novel approach that has not been proposed or applied in any previous research. The novelty and uniqueness of this proposal lie in the combined and synchronized use of multiple data exploration techniques to compute, extract, and represent the relationships and correlations between APT attack behaviors based on network traffic. Based on this data exploration technique, numerous significant attributes and anomalous behaviors of APT attacks have been synthesized and extracted.