APT Behaviors Detection Based on Email Business Scenarios

Advanced Persistent Threat (APT) is considered a serious problem faced by governments and enterprises. The detection method of APT should be different from general cyber-attacks because of its characteristics of persistence, camouflage and indirection, and there's no strategy that is effective enough at present. In this paper, we introduce business scenarios of email into APT detection to make our approach more targeted to anomalous behaviors which are caused by APT than other general cyber-attacks. We combine the key information of email protocols and factors of behaviors in business scenarios to extract more targeted features and learn deep features using deep learning algorithms. Then we summarize Tactics, Techniques, and Procedures (TTPs) based on email business scenarios in order to detect APT emails more effectively. Our experiments are conducted on a real dataset that up to 10,850,796 emails from October 2016 till January 2021, and we discovered 3 cases of real APT campaigns and also a new type of APT behaviors that is not detected by previous works.