A Segmented Sliding Window-Based Comprehensive Periodic Feature Extraction Method for APT Classification

This paper studies the classification problem of Advanced Persistent Threat (APT) attacks and proposes a comprehensive periodic feature extraction method based on sliding window division. A new data processing approach is proposed. Considering the characteristics of APT attacks, the life cycle of APT traffic data is divided into three stages. The traffic data from each stage is sampled in a piecewise manner and divided into separate training and testing sets, and then the training and testing subsets are merged. For the integrated sets, a sliding window-based partition approach is employed to obtain training and testing window samples, while extracting features from each individual sample. Then, this paper proposes a differential-based periodic feature extraction methodology to capture the dynamic information present in APT traffic and integrate it with fundamental static features, thereby forming effective comprehensive features. After combining these static and differential features, a comprehensive foundation is established for model training. Finally, the effectiveness of the algorithm is verified using decision tree model, and its superiority is demonstrated by comparing it with traditional partition methods based on data streams.