Performance Analysis of Machine Learning Models for Advanced Persistent Threat Detection

Advanced Persistent Threats (APTs) are multi-stage cyberattacks that persist over extended periods, allowing adversaries to infiltrate, maintain control, and adapt within targeted networks. A thorough review of existing studies on APT detection using machine learning (ML) reveals that most models report accuracies ranging from 89% to 99%. This paper explores the use of ML techniques for APT detection by conducting experimental analyses on various ML models applied to simulated network traffic. We evaluate multiple machine learning models through iterative experimentation and hyperparameter tuning. Our findings demonstrate that gradient boosting models, XGBoost (XGB) and LightGBM (LGBM), significantly outperform other classifiers in terms of classification accuracy on both test and synthetic datasets, while also maintaining lower computational overhead during training. This research highlights the potential of these models in enhancing the effectiveness of APT detection systems. Future work may focus on optimizing these models for realtime applications, incorporating anomaly-based detection, and exploring hybrid ML approaches to build more robust APT defense systems.