English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Advanced Persistent Threat (APT) attack, also known as directed threatattack, refers to the continuous and effective attack activities carried out byan organization on a specific object. They are covert, persistent and targeted,which are difficult to capture by traditional intrusion detection system(IDS).The traffic generated by the APT organization, which is the organization thatlaunch the APT attack, has a high similarity, especially in the Command andControl(C2) stage. The addition of features for APT organizations caneffectively improve the accuracy of traffic detection for APT attacks. Thispaper analyzes the DNS and TCP traffic of the APT attack, and constructs twonew features, C2Load_fluct (response packet load fluctuation) and Bad_rate (badpacket rate). The analysis showed APT attacks have obvious statistical laws inthese two features. This article combines two new features with common featuresto classify APT attack traffic. Aiming at the problem of data loss and boundarysamples, we improve the Adaptive Synthetic(ADASYN) Sampling Approach andpropose the PADASYN algorithm to achieve data balance. A traffic classificationscheme is designed based on the AdaBoost algorithm. Experiments show that theclassification accuracy of APT attack traffic is improved after adding newfeatures to the two datasets so that 10 DNS features, 11 TCP and HTTP/HTTPSfeatures are used to construct a Features set. On the two datasets, F1-scorecan reach above 0.98 and 0.94 respectively, which proves that the two newfeatures in this paper are effective for APT traffic detection.

Construction of Two Statistical Anomaly Features for Small-Sample APT Attack Traffic Classification