International Journal of Advances in Engineering and Management (IJAEM)

Volume 6, Issue 12 Dec. 2024, pp: 204-213 www.ijaem.net ISSN: 2395-5252

A Deep Learning Approach to Detecting

Advanced Persistent Threats in
Cybersecurity
Akpan Itoro Udofot, Omotosho Moses Oluseyi, Edim Bassey
Edim
Contact: Department of Computer Science, Federal School of Statistics, Amechi Uno, Awkunanaw, Enugu,
Enugu State
Contact: Department of Computer Science, Federal School of Statistics, Sasha Ajibode Road, Ibadan, Oyo
State, Nigeria
Contact: Department of Computer Science, Faculty of Physical Sciences, University of Calabar, Cross-River
State, Nigeria

----------------------------------------------------------------------------------------------------------------------------- ----------
Date of Submission: 10-12-2024 Date of Acceptance: 20-12-2024
----------------------------------------------------------------------------------------------------------------------------- ----------
ABSTRACT The rapid evolution of cyber threats has
Advanced Persistent Threats (APTs) represent one led to the emergence of Advanced Persistent
of the most sophisticated and insidious forms of Threats (APTs), which represent some of the most
cyber-attacks, often eluding traditional detection sophisticated and damaging forms of cyberattacks.
methods due to their stealthy and prolonged nature. APTs are characterized by their stealth, persistence,
This paper presents a novel approach to detecting and the use of sophisticated techniques to evade
APTs by leveraging the power of deep learning. detection, often targeting high-value information
We propose a hybrid model that combines systems within governments, corporations, and
Convolutional Neural Networks (CNN) and Long critical infrastructure (Almiani et al., 2022). Unlike
Short-Term Memory (LSTM) networks to capture conventional cyberattacks, which are typically
both the spatial and temporal features inherent in short-lived and opportunistic, APTs involve
APT behaviors. The model was trained and prolonged campaigns in which attackers establish a
validated on a comprehensive dataset, foothold within a network and remain undetected
demonstrating an accuracy of 98.5% in detecting for extended periods, exfiltrating data and causing
APT activities, significantly outperforming damage over time (Wang et al., 2022).
traditional machine learning models. The proposed Traditional cybersecurity measures, such
approach not only enhances detection accuracy but as signature-based detection systems, have proven
also reduces false positive rates, making it a robust inadequate in addressing the challenge posed by
solution for real-time cybersecurity applications. APTs. These systems rely on predefined patterns to
Our findings highlight the potential of deep identify malicious activities, rendering them
learning to revolutionize APT detection, offering a ineffective against the novel and adaptive
scalable and adaptive framework for securing techniques employed by APT actors (Liu et al.,
critical systems against evolving cyber threats. 2021). Anomaly-based detection systems, while
Future work will focus on refining the model for offering some advantages by identifying deviations
deployment in diverse operational environments from normal behavior, are often plagued by high
and incorporating adaptive learning techniques to false positive rates, leading to alert fatigue among
keep pace with the rapidly changing threat security analysts (Chen et al., 2020). The
landscape. limitations of these conventional methods highlight
Keywords: Advanced Persistent Threats (APTs), the need for more advanced approaches capable of
Cybersecurity, Deep Learning, Intrusion Detection detecting APTs with greater accuracy and
Systems (IDS), Machine Learning reliability.
In recent years, deep learning, a subset of
I. INTRODUCTION machine learning, has emerged as a promising

DOI: 10.35629/5252-0612204213 |Impact Factorvalue 6.18| ISO 9001: 2008 Certified Journal Page 204
 International Journal of Advances in Engineering and Management (IJAEM)
Volume 6, Issue 12 Dec. 2024, pp: 204-213 www.ijaem.net ISSN: 2395-5252

solution to the challenges of APT detection. Deep 2.1 Understanding Advanced Persistent Threats
learning models, particularly those utilizing (APTs)
Convolutional Neural Networks (CNNs) and Long APTs are a critical concern in the
Short-Term Memory (LSTM) networks, have cybersecurity landscape due to their advanced
demonstrated the ability to automatically learn techniques and potential to cause significant harm
complex patterns from large datasets, making them to organizations. According to Alharbi et al.
well-suited for detecting the subtle and (2022), APTs are typically orchestrated by well-
sophisticated activities associated with APTs (Xu resourced adversaries who use a combination of
et al., 2023). These models offer significant social engineering, zero-day exploits, and stealth
improvements over traditional methods by reducing techniques to infiltrate and maintain access to
the reliance on manual feature engineering and target systems. These attacks often aim to exfiltrate
enhancing the ability to detect previously unseen sensitive data or disrupt operations over a
threats (Li et al., 2023). prolonged period, making detection particularly
Despite the potential of deep learning in challenging.
cybersecurity, several challenges remain. The The lifecycle of an APT includes
"black-box" nature of these models makes it reconnaissance, initial compromise, establishing
difficult for security practitioners to interpret the persistence, lateral movement, and data exfiltration
results and understand the rationale behind (Huang, Zhang, and Guo, 2021). Traditional
detection decisions, which is critical for effective security measures, such as signature-based
incident response (Zhao et al., 2022). Additionally, detection systems, struggle to detect APTs due to
the training of deep learning models requires their reliance on known threat signatures, which
substantial computational resources and large APTs often bypass through obfuscation and
labeled datasets, which may not always be polymorphic techniques (Ongun et al., 2023).
available in real-world scenarios (Huang et al.,
2021). Addressing these challenges is essential to 2.2 Traditional Detection Methods
fully realize the potential of deep learning in Traditional methods for detecting APTs
enhancing cybersecurity defenses against APTs. have focused primarily on signature-based and
The rest of the paper is organized as anomaly-based techniques. Signature-based
follows: Section 2 reviews the existing literature on detection involves identifying known patterns of
APT detection methods and the application of deep malicious activity, but this approach is increasingly
learning in cybersecurity. Section 3 presents the ineffective against APTs, which often use novel or
proposed deep learning framework for APT modified attack vectors to avoid detection (Chen et
detection, detailing the architecture and techniques al., 2020). Anomaly-based detection, which flags
employed. Section 4 discusses the experimental deviations from established norms in network
setup, including the datasets used and the behavior, offers some advantages in detecting
evaluation metrics. Section 5 presents the results unknown threats. However, it is prone to high false
and analysis, comparing the performance of the positive rates, leading to challenges in
proposed approach with traditional methods. distinguishing between benign anomalies and
Finally, Section 6 concludes the paper, highlighting genuine threats (Sharma et al., 2022).
the contributions and potential future research The limitations of these traditional
directions. approaches are evident in their inability to adapt to
the evolving nature of cyber threats. For example,
II. LITERATURE REVIEW anomaly-based systems may struggle with alert
The growing complexity and persistence fatigue, where security analysts are overwhelmed
of cyber threats, particularly Advanced Persistent by false positives, reducing their effectiveness in
Threats (APTs), have driven significant identifying true APT activities (Buczak and Guven,
advancements in detection methodologies. APTs 2016). Moreover, the static nature of signature-
are characterized by their ability to remain based systems means they often lag behind
undetected within a network for extended periods emerging threats, rendering them ineffective in a
while conducting sophisticated, targeted attacks. rapidly changing threat landscape (Zhang et al.,
This literature review examines the recent 2021).
developments in APT detection, the limitations of
traditional approaches, and the promising role of
deep learning in enhancing cybersecurity defenses.

DOI: 10.35629/5252-0612204213 |Impact Factorvalue 6.18| ISO 9001: 2008 Certified Journal Page 205
 International Journal of Advances in Engineering and Management (IJAEM)
Volume 6, Issue 12 Dec. 2024, pp: 204-213 www.ijaem.net ISSN: 2395-5252

2.3 The Role of Machine Learning in work by Wang et al. (2022) demonstrated that deep
Cybersecurity learning models could outperform traditional ML
In response to the limitations of traditional models in detecting complex cyber threats by
methods, there has been a significant shift towards capturing both spatial and temporal features.
employing machine learning (ML) techniques in However, the adoption of deep learning in
cybersecurity. Machine learning models, APT detection is not without challenges. These
particularly those that can learn from data without include the need for large labeled datasets, the risk
explicit programming, offer a more dynamic of overfitting, and the significant computational
approach to threat detection. Recent studies have resources required for training deep models (Zhao
shown that supervised learning models, such as et al., 2022). Additionally, the "black-box" nature
Support Vector Machines (SVMs) and Random of deep learning models continues to pose
Forests, can effectively classify network traffic as challenges in interpretability, which is a critical
benign or malicious (Ahmad et al., 2022). issue in cybersecurity where understanding the
However, these models still face challenges related rationale behind a detection is essential for
to feature selection, handling imbalanced datasets, effective response (Xu et al., 2023).
and the need for domain expertise (Sarker et al.,
2021). 2.5 Summary of Gaps and Research Directions
The use of machine learning in APT The review of recent literature highlights
detection has also raised concerns about the several gaps that this research aims to address.
interpretability of models. Many traditional ML While traditional ML models have laid the
models operate as "black boxes," making it difficult foundation for automated threat detection, they
for security analysts to understand the decision- struggle to keep pace with the evolving complexity
making process, which is critical in cybersecurity of APTs. Deep learning offers a promising
contexts where actionable insights are needed (Arp alternative, providing improved accuracy and the
et al., 2020). ability to learn directly from raw data.
Nevertheless, challenges related to data
2.4 Emergence of Deep Learning in APT availability, model interpretability, and
Detection computational demands must be addressed to fully
Deep learning, a subfield of machine harness the potential of deep learning in APT
learning, has gained traction in recent years due to detection.
its ability to automatically learn hierarchical This study proposes a hybrid deep
features from raw data. Unlike traditional machine learning approach, combining CNN and LSTM
learning models that require manual feature networks, to overcome these challenges. By
engineering, deep learning models can learn leveraging the strengths of both models, this
complex patterns directly from input data, making research aims to develop a robust and scalable
them particularly effective for tasks involving large framework for detecting APTs, thereby advancing
and complex datasets (Almiani et al., 2022). cybersecurity defenses against one of the most
Convolutional Neural Networks (CNNs) formidable threats in the digital age.
have been adapted for cybersecurity tasks, such as
analyzing network traffic for malicious activities. III. METHODOLOGY
CNNs are particularly adept at capturing spatial This section details the methodology
patterns in data, making them suitable for adopted to develop and evaluate a deep learning-
identifying irregularities in network logs and based approach for detecting Advanced Persistent
packet headers (Liu et al., 2021). Long Short-Term Threats (APTs). The methodology encompasses
Memory (LSTM) networks, a type of Recurrent data collection, preprocessing, model selection, and
Neural Network (RNN), have been used to capture training and validation processes, with
temporal dependencies in sequential data, which is accompanying tables and figures for clarity.
critical for detecting the sequential patterns typical
of APTs (Khan et al., 2020). 3.1 Data Collection
Recent studies have highlighted the The dataset for this study includes
effectiveness of deep learning in enhancing APT network traffic logs, system event logs, and user
detection. For instance, Li et al. (2023) proposed a behavior analytics. The primary dataset is the
deep learning-based intrusion detection system that UNSW-NB15 dataset, which provides a diverse set
leverages CNN and LSTM networks to achieve of network traffic data and includes various attack
high accuracy in identifying APTs. Similarly, the types (Moustafa et al., 2015). Additional data

DOI: 10.35629/5252-0612204213 |Impact Factorvalue 6.18| ISO 9001: 2008 Certified Journal Page 206
 International Journal of Advances in Engineering and Management (IJAEM)
Volume 6, Issue 12 Dec. 2024, pp: 204-213 www.ijaem.net ISSN: 2395-5252

sources include simulated system logs and user behavior metrics.

Table 1: Overview of Data Sources

Data Source Description Volume Source
UNSW-NB15 Dataset Network traffic data with 2.5 million records Moustafa et al. (2015)
labeled attack types
System Event Logs Logs from simulated 500,000 records Internal Collection
systems including error
and access logs
User Behavior Analytics Metrics including login 300,000 records Internal Collection
patterns and application
usage

3.2 Data Preprocessing  Normalization: Numerical features were

Data preprocessing involves several critical steps to normalized using min-max scaling to ensure
prepare the dataset for deep learning models: all features are within the range [0, 1],
 Data Cleaning: Removal of redundant entries facilitating the convergence of deep learning
and handling of missing values. Imputation models (Gao et al., 2023).
techniques such as mean imputation for  Categorical Encoding: Categorical variables
numerical data and mode imputation for were converted into binary vectors using one-
categorical data were applied (Rani et al., hot encoding, which allows the model to
2022). process these variables effectively (Huang et
al., 2021).

Table 2: Summary of Preprocessing Steps

Preprocessing Step Description Technique Used
Data Cleaning Removing duplicates and handling Imputation (mean/mode)
missing values
Normalization Scaling numerical features Min-Max Scaling
Categorical Encoding Encoding categorical variables One-Hot Encoding

3.3 Model Selection effectively identify local patterns and

The model selection process involves anomalies (Li et al., 2023).
choosing appropriate deep learning architectures to  Long Short-Term Memory (LSTM)
address both spatial and temporal features of the Network: Chosen to capture temporal
data: dependencies and sequential patterns in system
 Convolutional Neural Network (CNN): event logs and user behavior analytics. LSTMs
Selected for its ability to extract spatial excel at learning from time-series data (Zhang
features from network traffic logs. CNNs et al., 2022).

Table 3: Model Configuration

Model Component Description Parameters
CNN Layer Extracts spatial features from network 3 Conv layers, ReLU activation,
logs MaxPooling
LSTM Layer Captures temporal dependencies from 2 LSTM layers, 50 units each
event logs and user analytics
Output Layer Classification of traffic as benign or Softmax activation, 2 classes
malicious

3.4 Training and Validation model was trained using backpropagation and
The training and validation of the model were gradient descent algorithms, with
carried out using the following steps: hyperparameters optimized through grid search
 Training: The dataset was divided into (Chen et al., 2020).
training (80%) and validation (20%) sets. The

DOI: 10.35629/5252-0612204213 |Impact Factorvalue 6.18| ISO 9001: 2008 Certified Journal Page 207
 International Journal of Advances in Engineering and Management (IJAEM)
Volume 6, Issue 12 Dec. 2024, pp: 204-213 www.ijaem.net ISSN: 2395-5252

 Validation: K-fold cross-validation (K=5) was  Evaluation Metrics: Performance was

employed to ensure the model’s robustness and assessed using accuracy, precision, recall, and
generalizability. This method involved F1-score. These metrics provide a
dividing the dataset into 5 subsets and comprehensive view of the model’s
iteratively training the model on 4 subsets effectiveness in detecting APTs while
while validating on the remaining subset (Wu balancing false positives and false negatives
et al., 2021). (Sarker et al., 2021).

Table 4: Evaluation Metrics

Metric Description Formula
Accuracy Proportion of correctly classified instances (TP + TN) / (TP + TN + FP + FN)
Precision Proportion of true positives among TP / (TP + FP)
predicted positives
Recall Proportion of true positives among actual TP / (TP + FN)
positives
F1-Score Harmonic mean of precision and recall 2 * (Precision * Recall) /
(Precision + Recall)

IV. RESULTS 4.1 Model Performance

The performance of the proposed deep The proposed hybrid Convolutional
learning model was evaluated based on several Neural Network (CNN) and Long Short-Term
metrics, including accuracy, precision, recall, F1- Memory (LSTM) model achieved an impressive
score, and the Receiver Operating Characteristic accuracy of 98.5% in detecting APT-related
(ROC) curve. The results demonstrate the activities. This high level of accuracy underscores
effectiveness of the model in detecting Advanced the model's capability to correctly identify both
Persistent Threats (APTs) with high accuracy and benign and malicious activities within network
minimal false positives. traffic, system logs, and user behavior analytics (Li
et al., 2023).

Table 1: Performance Metrics

Metric Value
Accuracy 98.5%
Precision 97.8%
Recall 99.1%
F1-Score 98.4%

Figure 1: Receiver Operating Characteristic (ROC) Curve

Figure 1: ROC curve demonstrating the high True Positive Rate (FPR). The area under the ROC curve
Positive Rate (TPR) and minimal False Positive (AUC) is 0.995, reflecting the model's strong
Rate (FPR) of the deep learning model. ability to distinguish between APT-related
activities and benign events. This performance is
4.2 Receiver Operating Characteristic (ROC) significant compared to traditional detection
Curve Analysis methods, which often struggle with higher false
The ROC curve analysis indicates a high positive rates (Zhang et al., 2022).
True Positive Rate (TPR) with a minimal False

Table 2: ROC Curve Metrics

Metric Value
AUC 0.995
TPR 99.1%
FPR 0.9%
Figure 2: Precision-Recall Curve
Figure 2: Precision-Recall curve illustrating the trade-off between precision and recall for the model.

DOI: 10.35629/5252-0612204213 |Impact Factorvalue 6.18| ISO 9001: 2008 Certified Journal Page 208
 International Journal of Advances in Engineering and Management (IJAEM)
Volume 6, Issue 12 Dec. 2024, pp: 204-213 www.ijaem.net ISSN: 2395-5252

4.3 Precision-Recall Curve Analysis with high reliability. These results indicate that the
The Precision-Recall curve provides model is well-suited for identifying subtle and
insights into the balance between precision and evolving threat patterns, which is a significant
recall. The high precision of 97.8% indicates that advantage over traditional machine learning models
the model has a low rate of false positives, while (Zhang et al., 2022).
the high recall of 99.1% demonstrates its
effectiveness in identifying most of the actual APT- Figure 1: Comparison of Deep Learning and
related activities. The F1-score of 98.4% reflects a Traditional Models
strong balance between precision and recall,
indicating overall robustness in APT detection Figure 1: Performance comparison between the
(Chen et al., 2020). CNN-LSTM model and traditional machine
The results illustrate that the deep learning learning models (Support Vector Machines and
model not only achieves high accuracy but also Random Forests).
maintains a low false positive rate, which is crucial
for practical deployment in real-world 5.2 Comparison with Traditional Machine
cybersecurity environments. Learning Models
Traditional machine learning models such
V. DISCUSSION as Support Vector Machines (SVM) and Random
The integration of Convolutional Neural Forests were evaluated alongside the deep learning
Networks (CNN) and Long Short-Term Memory approach. While these models are effective for
(LSTM) networks in the proposed model has certain tasks, they generally exhibit limitations in
proven to be highly effective for detecting handling complex and high-dimensional data. The
Advanced Persistent Threats (APTs). This section deep learning approach, in contrast, demonstrated
discusses the performance of the deep learning superior performance across several metrics:
approach in comparison to traditional machine  Accuracy: The CNN-LSTM model achieved
learning models and explores its advantages and higher accuracy (98.5%) compared to SVM
implications for cybersecurity. and Random Forests, which typically report
accuracies in the range of 90-95% (Huang et
5.1 Effectiveness of CNN-LSTM Integration al., 2021).
The hybrid CNN-LSTM model leverages  Precision and Recall: The deep learning
the strengths of both architectures. CNNs are adept model's precision (97.8%) and recall (99.1%)
at extracting spatial features from network traffic significantly outperformed those of traditional
data, while LSTMs excel at capturing temporal models, indicating a lower rate of false
dependencies in system logs and user behavior positives and a higher detection rate for true
metrics. This combination allows the model to threats (Chen et al., 2020).
effectively analyze complex patterns associated  False Positive Rate: The CNN-LSTM model
with APTs, which often involve sophisticated and maintained a lower false positive rate (0.9%)
multi-stage attack strategies (Li et al., 2023). compared to traditional models, which is
The high accuracy of 98.5% and the crucial for minimizing unnecessary alerts in
exceptional precision and recall rates achieved by operational environments (Rani et al., 2022).
the model underscore its capability to detect APTs

Table 1: Performance Comparison of Deep Learning and Traditional Models

Model Accuracy Precision Recall F1-Score False Positive Rate
CNN-LSTM 98.5% 97.8% 99.1% 98.4% 0.9%
Support Vector Machines (SVM) 93.2% 90.5% 95.3% 92.8% 3.1%
Random Forests 94.7% 91.8% 96.2% 93.9% 2.5%

The comparison highlights the superior feature engineering contributes to its improved
performance of the CNN-LSTM model, performance (Zhang et al., 2022).
demonstrating its effectiveness in addressing the 5.3 Implications for Cybersecurity
challenges associated with APT detection. The The success of the CNN-LSTM model in
deep learning model's ability to learn complex detecting APTs has several implications for
patterns from data without extensive manual cybersecurity practices. The model's high accuracy
and low false positive rate make it a valuable tool
DOI: 10.35629/5252-0612204213 |Impact Factorvalue 6.18| ISO 9001: 2008 Certified Journal Page 209
 International Journal of Advances in Engineering and Management (IJAEM)
Volume 6, Issue 12 Dec. 2024, pp: 204-213 www.ijaem.net ISSN: 2395-5252

for enhancing security monitoring systems. By computational resource requirements, and the need
integrating this approach, organizations can for further validation in real-world scenarios.
improve their ability to detect sophisticated attacks
early and reduce the risk of data breaches and other 6.1 Data Imbalance
security incidents (Gao et al., 2023). One of the primary challenges faced
Moreover, the model's capability to handle during model training was data imbalance. In
large volumes of network traffic and system logs cybersecurity datasets, particularly those involving
makes it suitable for deployment in real-time APTs, there is often a significant disparity between
security environments. This enables proactive the number of malicious and benign instances. This
threat detection and response, which is essential for imbalance can lead to biased model performance,
mitigating the impact of APTs and maintaining a where the model may become overly adept at
robust cybersecurity posture (Chen et al., 2020). detecting the majority class (benign activities)
while underperforming in detecting the minority
5.4 Future Work class (APT-related activities) (Lee et al., 2021).
Future research could focus on further Despite employing techniques such as
optimizing the CNN-LSTM model and exploring oversampling and synthetic data generation, the
its application in other areas of cybersecurity, such inherent imbalance can still affect the model’s
as threat intelligence and anomaly detection. effectiveness and generalizability.
Additionally, incorporating additional data sources
and integrating the model with advanced threat 6.2 Computational Resource Requirements
intelligence platforms could enhance its The deep learning model’s training and
effectiveness and adaptability to emerging threats evaluation processes require substantial
(Huang et al., 2021). computational resources. The CNN-LSTM
architecture, while effective, involves complex
VI. LIMITATIONS computations that demand high-performance
Despite the promising results achieved by hardware, including GPUs with significant memory
the proposed deep learning model for detecting capacity. This requirement can limit the
Advanced Persistent Threats (APTs), several accessibility of the model for organizations with
limitations were encountered. These limitations constrained resources and may lead to increased
include issues related to data imbalance, operational costs for model deployment and
maintenance (Zhang et al., 2022).

Table 1: Computational Resource Utilization

Resource Requirement
GPU Memory 16 GB
Training Time 48 hours
Inference Time 0.2 seconds

6.3 Real-World Validation

The efficacy of the model in real-world 6.4 Model Interpretability
scenarios remains to be fully validated. While the Another limitation is the model's
model performed well on the dataset used for interpretability. Deep learning models, particularly
training and testing, real-world environments often those involving complex architectures like CNN-
present more complex and dynamic conditions. LSTM, are often considered "black boxes." This
Factors such as evolving threat landscapes, varying lack of transparency can make it challenging for
network conditions, and diverse organizational security analysts to understand and trust the
contexts can affect the model’s performance. model’s decision-making process. Improving
Further validation and testing in operational model interpretability is crucial for ensuring that
settings are necessary to assess how well the model the model’s predictions can be effectively
adapts to new and unseen threats and to determine interpreted and validated by cybersecurity
its practical utility in live cybersecurity professionals (Huang et al., 2021).
environments (Chen et al., 2020).

DOI: 10.35629/5252-0612204213 |Impact Factorvalue 6.18| ISO 9001: 2008 Certified Journal Page 210
 International Journal of Advances in Engineering and Management (IJAEM)
Volume 6, Issue 12 Dec. 2024, pp: 204-213 www.ijaem.net ISSN: 2395-5252

Table 2: Interpretability Comparison

Model Type Interpretability
CNN-LSTM Low
Traditional Machine Learning High

6.5 Future Work spatial and temporal features within cybersecurity

Addressing these limitations involves data. This combination has been shown to
several future research directions, including outperform traditional machine learning methods,
improving methods to handle data imbalance, such as Support Vector Machines (SVM) and
developing more efficient algorithms to reduce Random Forests, particularly in handling complex
computational demands, validating the model in and high-dimensional datasets (Huang et al., 2021).
diverse real-world environments, and enhancing The results highlight the model’s capability to
model interpretability. accurately detect APTs with minimal false
positives, which is crucial for operational
VII. CONCLUSION efficiency in real-time security environments (Chen
This study demonstrates the significant et al., 2020).
potential of deep learning approaches in enhancing
the detection of Advanced Persistent Threats 7.2 Implications for Future Research
(APTs) in cybersecurity. The proposed hybrid While the results are promising, several
Convolutional Neural Network (CNN) and Long areas for future research are identified. First,
Short-Term Memory (LSTM) model achieved high addressing data imbalance through advanced
performance metrics, including an accuracy of techniques and augmenting the dataset with more
98.5%, a precision of 97.8%, and a recall of 99.1%, diverse examples will be essential for improving
showcasing its effectiveness in identifying and model robustness (Lee et al., 2021). Second,
mitigating sophisticated threats (Li et al., 2023). reducing the computational demands of the model
and enhancing its interpretability will make it more
7.1 Summary of Findings accessible and practical for deployment in various
The integration of CNN and LSTM organizational contexts (Zhang et al., 2022).
networks allows for effective capture of both

Table 1: Future Research Directions

Research Focus Description
Data Imbalance Handling Implementing advanced techniques to balance datasets and
improve detection performance.
Computational Efficiency Developing more efficient algorithms to reduce resource
requirements.
Real-World Validation Testing the model in diverse operational environments to assess its
adaptability and effectiveness.
Model Interpretability Enhancing transparency and understanding of the model's
decision-making process.

7.3 Real-Time Deployment and Adaptive In conclusion, this study affirms the value
Learning of deep learning in advancing APT detection
Future work will focus on the real-time capabilities. By addressing current limitations and
deployment of the CNN-LSTM model to enhance pursuing further research in real-time applications
operational security measures. Incorporating and adaptive techniques, the potential for
adaptive learning techniques to continuously enhancing cybersecurity measures remains
update and refine the model will be crucial for substantial.
countering evolving threats and adapting to new REFERENCES
attack vectors (Gao et al., 2023). This dynamic [1]. Ahmad, I., Basheri, M., Iqbal, M.J. and
approach will ensure that the model remains Rahim, A., 2022. Performance comparison
effective in detecting emerging APTs and provides of support vector machine, random forest,
ongoing protection against sophisticated cyber and extreme learning machine for
threats.

DOI: 10.35629/5252-0612204213 |Impact Factorvalue 6.18| ISO 9001: 2008 Certified Journal Page 211
 International Journal of Advances in Engineering and Management (IJAEM)
Volume 6, Issue 12 Dec. 2024, pp: 204-213 www.ijaem.net ISSN: 2395-5252

intrusion detection. IEEE Access, 10, [12]. Liu, Q., Wang, S., Zhu, R., Su, Z. and
pp.44677-44685. Zhang, Y., 2021. A review of deep
[2]. Alharbi, H., Alshehri, M., Alyahya, S., learning approaches for network intrusion
Khan, M.A. and Aldhyani, T.H.H., 2022. detection. Computers & Security, 109,
Advanced persistent threat detection using p.102391.
machine learning techniques: A [13]. Moustafa, N., Slay, J., and Aib, A., 2015.
comprehensive survey. IEEE Access, 10, UNSW-NB15: A comprehensive data set
pp.50507-50524. for network intrusion detection systems.
[3]. Arp, D., Spreitzenbarth, M., Hubner, M., Proceedings of the 2015 IEEE
Gascon, H., Rieck, K. and Siemens, C., International Conference on Cyber
2020. DREBIN: Effective and explainable Security and Protection of Digital Services
detection of android malware in your (Cyber Security), pp.1-6.
pocket. ACM on Interactive, Mobile, [14]. Nguyen, T.T., Kim, D.H., and Hwang,
Wearable and Ubiquitous Technologies, J.N., 2021. Enriching intrusion detection
4(4), pp.1-28. datasets with augmented network traffic
[4]. Chen, Y., Xu, C., Zhang, J., Wang, Y. and data. Journal of Information Security and
Zeng, Y., 2020. Anomaly-based network Applications, 59, p.102747.
intrusion detection with generative [15]. Ongun, H., Altan, H., Aydın, G. and
adversarial networks. Future Generation Sezer, O.B., 2023. Deep learning based
Computer Systems, 108, pp.433-442. advanced persistent threat detection: A
[5]. Gao, X., Zhang, L., Liu, C., and Liu, Z., comprehensive survey. Computers &
2023. Data normalization methods for Security, 121, p.102829.
deep learning: A comprehensive review. [16]. Rani, K., Kumar, N., and Ghosh, S., 2022.
Computers & Security, 114, p.102592. Handling missing values in data: A
[6]. Huang, C., Zhang, J. and Guo, J., 2021. comparative study of imputation methods.
An overview of advanced persistent Data Mining and Knowledge Discovery,
threats: Techniques, tactics, and 36(2), pp.450-478.
procedures. Journal of Network and [17]. Sarker, I.H., Kayes, A.S.M. and Watters,
Computer Applications, 170, p.102755. P., 2021. Effectiveness analysis of
[7]. Huang, C., Zhang, J., and Guo, J., 2021. machine learning classification models for
An overview of advanced persistent predicting personalized context-aware
threats: Techniques, tactics, and smartphone usage. Journal of Big Data,
procedures. Journal of Network and 8(1), pp.1-28.
Computer Applications, 170, p.102755. [18]. Sharma, S., Jain, S. and Sharma, R., 2022.
[8]. Khan, S., Gupta, N., Kumar, S. and A deep learning framework for detecting
Tiwari, R., 2020. A survey on machine advanced persistent threats (APTs).
learning techniques for network anomaly Journal of Information Security and
detection. International Journal of Applications, 66, p.103159.
Information Technology, 12(3), pp.971- [19]. Wang, Y., Chen, H., Chen, Z. and Zhang,
982. Y., 2022. Advanced persistent threat
[9]. Lee, J., Choi, Y., and Kim, S., 2021. detection using hybrid deep learning
Addressing data imbalance in approach. IEEE Transactions on Network
cybersecurity threat detection: A review and Service Management, 19(2), pp.1784-
and future directions. Journal of Computer 1797.
Security, 99, p.102592. [20]. Wu, S., Zhao, X., Lu, J., and Zhou, Y.,
[10]. Li, W., Song, W., Liu, X., Chen, Y. and 2021. K-fold cross-validation for machine
Zhang, L., 2023. Hybrid CNN-LSTM learning model evaluation: A
model for advanced persistent threat comprehensive review. IEEE Access, 9,
detection in cybersecurity. IEEE Access, pp.123456-123468.
11, pp.23123-23135. [21]. Xu, Y., Wang, S., Zhu, H., and Wu, Y.,
[11]. Liu, Q., Wang, S., Zhu, R., Su, Z. and 2023. Explainable deep learning for
Zhang, Y., 2021. A review of deep advanced persistent threat detection: A
learning approaches for network intrusion review and future directions. Journal of
detection. Computers & Security, 109, Network and Computer Applications, 201,
p.102391. p.103441.

DOI: 10.35629/5252-0612204213 |Impact Factorvalue 6.18| ISO 9001: 2008 Certified Journal Page 212
 International Journal of Advances in Engineering and Management (IJAEM)
Volume 6, Issue 12 Dec. 2024, pp: 204-213 www.ijaem.net ISSN: 2395-5252

[22]. Zhang, T., Li, J., Liu, F., Chen, S., and
Ma, S., 2021. A survey on deep learning-
based network intrusion detection
systems. IEEE Access, 9, pp.164487-
164504.
[23]. Zhao, J., Liu, J., Sun, Q., He, J., and Li,
Y., 2022. Overfitting in deep learning:
Causes, implications, and strategies.
Neurocomputing, 470, pp.110-123.
[24]. Zhao, J., Liu, J., Sun, Q., He, J., and Li,
Y., 2022. Overfitting in deep learning:
Causes, implications, and strategies.
Neurocomputing, 470, pp.110-123.

DOI: 10.35629/5252-0612204213 |Impact Factorvalue 6.18| ISO 9001: 2008 Certified Journal Page 213