A Hybrid IDS for APT Detection Using BI-LSTM Ensemble Learning
摘要
Advanced Persistent Threat (APT) are elusive and target well-defined, specialized targets. Detecting APT attacks remains challenging due to the lack of attention given to human behavioral factors contributing to APTs. With the increased number of cyber-attacks, the need for Intrusion Detection System (IDS) is rapidly growing. Traditional IDS rely on pattern matching models or basic activity analysis, they are unable to identify complex and current threats. Machine Learning (ML) based IDS are still in their infancy and frequently show poor accuracy and large false positive rates, rendering them useless for identifying newly developing cyberattacks. A novel IDS that utilizes Ensemble learning ML approach incorporated with Bi-LSTM classifier and LIME module technique for detection of APT was proposed and named the algorithm as RS_algorithm. This RS_algorithm was tested on the UNSW-NB15 dataset and achieved an accuracy of more than 99% and false positive rate less than 1%. This research concluded that the RS_algorithm is more effective than traditional ML approaches.