Predicting Advanced Persistent Threats using Cyber Threat Intelligence and Machine Learning Techniques

Abstract

APTs can be very advanced, able to hide within an organization for years, potentially compromising sensitive data and information. Old-fashioned signature-driven security tools don't keep up with the latest and most advanced attacks, and thus require proactive and intel-driven threats detection products. This research aims to design an early prediction and detection system of Advanced Persistent Threat activities with a machine learning system that works on Cyber Threat Intelligence. The architecture pulls together any and all threat intelligence gathered from network traffic logs, security alerts and external sources including Indicators of Compromise that include suspicious IP addresses, malicious website addresses, and other unusual communications. After data preprocessing and feature engineering, machine learning models such as Random Forest, Support Vector Machine, and Gradient Boosting are employed to learn the harmful user actions and foresee potentially high-risk actions. This suggested methodology is tested using the CICIDS2017 and UNSW-NB15 benchmark datasets of cyber security. It was observed from the experimental results that the best results has been obtained by Random Forest classifier with the highest accuracy as 97.8% after the differentiation of the legitimate and harmful activity. The results show that the integration of Cyber Threat Intelligence with machine learning has a significant impact on early threat detection, reduces the number of false-positive alerts and strengthens cyber security efforts to prevent Advanced Persistent Threat attacks.