A Novel Deep Learning Stack for APT Detection

This is a sel -a chi ed e sion o an o iginal a icle. This e sion may di e om he o iginal in pagina ion and ypog aphic de ails. Au ho (s): Ti le: Yea : Ve sion: Copy igh : Righ s: Righ s u l: Please ci e he o iginal e sion: CC BY 4.0 h ps://c ea i ecommons.o g/licenses/by/4.0/ A No el Deep Lea ning S ack o APT De ec ion © 2019 by The Au ho s. Licensee MDPI, Basel, Swi ze land. Published e sion Bods öm, Te o; Hämäläinen, Timo Bods öm, T., & Hämäläinen, T. (2019). A No el Deep Lea ning S ack o APT De ec ion. Applied Sciences, 9(6), A icle 1055. h ps://doi.o g/10.3390/app9061055 2019 applied sciences A icle A No el Deep Lea ning S ack o APT De ec ion Te o Bods öm * and Timo Hämäläinen Facul y o In o ma ion Technology, Uni e si y o Jy äskylä, 40014 Jy äskylä, Finland; [email p o ec ed] *Co espondence: e [email p o ec ed] Recei ed: 11 Feb ua y 2019; Accep ed: 8 Ma ch 2019; Published: 13 Ma ch 2019   Abs ac : We p esen a no el Deep Lea ning (DL) s ack o de ec ing Ad anced Pe sis en h ea (APT) a acks. This model is based on a heo e ical app oach whe e an APT is obse ed as a mul i- ec o mul i-s age a ack wi h a con inuous s a egic campaign. To cap u e hese a acks, he en i e ne wo k low and pa icula ly aw da a mus be used as an inpu o he de ec ion p ocess. By combining di e en ypes o ailo ed DL-me hods, i is possible o cap u e ce ain ypes o anomalies and beha iou . Ou me hod essen ially b eaks down a bigge p oblem in o smalle asks, ies o sol e hese sequen ially and inally e u ns a conclusi e esul . This concep pape ou lines, o example, he p oblems and possible solu ions o he asks. Addi ionally, we desc ibe how we will be de eloping, implemen ing and es ing he me hod in he nea u u e. Keywo ds: Ad anced Pe sis en Th ead (APT); Deep Lea ning (DL); ne wo k anomaly de ec ion 1. In oduc ion Due o he complexi y and dynamical beha iou o APT a acks, we p opose a sys em a chi ec u e o a no el p o o ype ha akes in o accoun he beha iou o hese sophis ica ed a acks while de ec ing anomalies. Thus, we need o conside ollowing issues: (i) ou lie s; (ii) da a dimensions; (iii) non-linea his o ical e en s; (i ) unde lying hidden in e connec ions; and ( ) p e iously unknown a acks. To cap u e ou lie s caused by APT, he sys em mus deal wi h he abo e-men ioned issues e ec i ely. The e o e, we need o de elop a s ack o Deep Lea ning (DL) me hods whe e each laye has i s own pu pose ins ead o ha ing one single me hod. Finally, he sys em equi es a da a usion unc ion whe e all de ec ed hos ile ou lie s a e collec ed and combined. The sys em a chi ec u e mus be ca e ully planned, empi ically es ed and op imised as well as he co ec da a ep esen a ion o he inpu mus be selec ed. APT a ack is a sophis ica ed ne wo k a ack, wi h he pu pose o long- e m espionage o maximal des uc ion o a ge sys ems and ne wo ks. I has mul iple unc ionali ies, which a e de eloped o a oid de ec ion o as long as possible. Some o hose unc ionali ies include mul iple simul aneous a ack ec o s wi h di e en phases, masque ading as communica ion da a, andom changes in execu ion ime in e als, ho izon al and e ical connec ions and mimicking legi ima e a ic [ 1 ]. A common way o execu e APT is ia spea - ishing email spoo ing a ack bu , i he e exis s an inside h ea , i can be execu ed e en inside he a ge ne wo k [2,3]. To he bes o ou knowledge, his ype o sys em a chi ec u e has no been p esen ed ye in academic esea ch, e en hough APT a ack de ec ion me hods ha e been p oposed. Nex , in Sec ion 2, cu en de ec ion p oblems a e b ie ly discussed. Then, in Sec ion 3, da a p ope ies and how hey ela e o de ec ion p ocess a e p esen ed. Sec ion 4desc ibes he DL de ec ion s ack wi h de ails and p elimina y complexi y e alua ion is included in Sec ion 5. The pape concludes wi h Sec ions 6and 7is ese ed o sugges ions o u u e wo ks. Appl. Sci. 2019,9, 1055; doi:10.3390/app9061055 www.mdpi.com/jou nal/applsci Appl. Sci. 2019,9, 1055 2 o 10 2. Cu en De ec ion P oblems In ou p e ious pape [ 1 ], we p oposed a no el me hod o de ec ing (APT) a acks by using OODA loop and Black Swan heo y. The pu pose o he me hod is o ake in o accoun cu en de ec ion p oblems and imp o e de ec ion a e o ea lie unknown a acks, which is cu en ly qui e low. In ou me hod, he in en ion is no o manipula e ne wo k da a low be o e i is passed o he de ec ion p ocess. Tha is, ins ead o , o example, educing dimensions o s anda dising inpu da a, we pass he da a di ec ly o he de ec ion p ocess. This way, one does no educe o e all complexi y o andomness o he da a. Cu en anomaly de ec ion esea ch [ 4 , 5 ] elies on simila me hods, whe e ou da ed and hea ily manipula ed da ase s, such as KDD98, KDDCUP99 and NSLKDD [ 6 ], a e used o benchma king p oposed me hods. Ano he issue is ha complex p oblems a e sol ed in a simple manne , ha is, one ype o me hod is used o handling he en i e p oblem, such as one ype o Machine Lea ning (ML) o Deep Lea ning (DL) algo i hm. Addi ionally, Albanese [ 7 ] e al. poin ed ou in hei esea ch ha cu en in usion de ec ion sys ems ely hea ily on a ack inge p in s, which a e da a sequences o iden i y an a ack, o a ack p o iles, which a e beha iou models o an a ack. Bo h men ioned me hods equi e p io knowledge o an a ack, hus canno be used o de ec ing ea lie unknown a acks. The au ho s p oposed a amewo k ha iden i ies sequence o e en s, sepa a es unexplained cases based on p io models and es ima es he p obabili y o an a ack. Mo eo e , Au [ 8 ] e al. s a ed ha he numbe o sma phones is inc easing and hey a e somewha ulne able, which inc eases he p obabili y o being a ic im o an APT. These de ices a e connec ed o cloud se ices all he ime, inc easing pe sonal da a ansmission, as well as he p obabili y o espionage. Conside ing men ioned issues, we can s a e ha he o e all complexi y in a ne wo k inc eases due o g owing numbe o de ices and da a ansmissions, which also adds mo e andomness o da a. Nicho [ 9 ] e al. s a ed in hei s udy ha he academic communi y has neglec ed esea ch ela ed o APT a acks, and, while esea ch exis s, i is oo ocused on de ec ing a acks a e wa ds. The e o e, hei app oach ocused on p e en ing human e o , which commonly is he eason ha a campaign ge s s a ed in he i s place. In addi ion, human e o canno be elimina ed comple ely, hus mo e esea ch on sophis ica ed de ec ion me hods a e also equi ed. As men ioned abo e, “...[APT a ack] eal- ime de ec ion migh no be possible no necessa y. Ins ead, he ocus is o d op he de ec ion ime om yea s o mon hs o an accep able one, ha is, days” [1]. 3. Da a P ope ies This sec ion desc ibes b ie ly di e en p ope ies ha da a ha e as well as he pu pose o he p oposed anomaly de ec ion p ocess. In his pape , he da a a e conside ed a combina ion o ne wo k packe heade s and payload. 3.1. Ou lie s Ou lie de ec ion has some se ious p oblems. One can hink ha a iny ou lie is no signi ican o he de ec ion p ocess. Howe e , in he case o APT and due o i s le el o sophis ica ion, i migh be he only way o de ec such an a ack. Fo men ioned issues, one has o selec a da a p ocessing me hod such ha he p ocessing does no modi y he da a s uc u e. Fo hese easons, in ou p oposed app oach, he ne wo k da a a e no manipula ed in any way. The de ec ion sys em inpu is aw bina y da a. 3.2. Da a Dimensions In many p oposed de ec ion me hods, da a dimensions a e educed o gaining speed and mo e compu a ional powe . This ype o app oach howe e can cause impo an ou lie s o anish, hus educing de ec ion a e. Appl. Sci. 2019,9, 1055 3 o 10 In ou p oposed me hod, da a dimensions a e le as hey a e. Fo example, TCP/IP packe heade and da a ields ha e a maximum leng h o 1500 by es in E he ne ne wo k and sp ead o e 27 dimensions. As was s a ed in ou ea lie pape [ 1 ], we implemen ed he DL s ack in a way ha i akes he da a inpu in bina y o m. Dimensionali y is high, as 1500 by es ep esen 12,000 dimensions in bina y, howe e each dimension has he alue o 0 o 1, hus da a s anda disa ion is no needed in inpu laye . An al e na i e op ion is o p esen da a ield alues as in ege s and use da a ame ields as a dimensionali y, o example 27 dimensions in TCP/IP packe . Wi h he la e app oach, da a alues a e highe , bu , as minimum and maximum alues a e known, s anda disa ion migh no be needed. I is wo h es ing bo h app oaches and compa ing which pe o ms be e , i any di e ence exis s. Wi h his app oach, he o iginal dimensionali y is kep in da a. 3.3. Non-Linea His o ical E en s Fo non-linea his o ical e en s, he e exis s wo known p oblems: (i) “du a ion blindness”; and (ii) “cu se o lea ning”. These issues may be sol ed wi h mul iple sequen ial neu al ne wo ks. Tha is, neu al ne wo ks a e ained in a ce ain pe iod o ime, o example e e y 24 h, and a s ack is buil wi h hese neu al ne wo ks. In his manne , de ec ed ou lie s a e passed h ough a ious neu al ne wo ks and a e checked o ea lie exis ence o a oid he du a ion blindness. This also educes he cu se o lea ning as neu al ne wo ks a e ained wi h ewe da a, hus educing he possibili y o o e i ing. Lu e al. s a ed ha e en he ansmission ime in e al du ing he APT communica ion is no egula . The da a low may also consis o mo e han one da a packe . Mo eo e , e en hough he low du a ion can be sho e han 5 s [ 10 ], we can s a e ha communica ion pa e ns can be de ec ed om his o ical ou lie s. 3.4. Unde lying Hidden In e connec ions A e he execu ion, an APT ends o seek ano he ulne able hos s and sp ead i sel h ough a local ne wo k, hus c ea ing hidden in e connec ions. By iden i ying hese unusual in e nal hos - o-hos connec ions, i is possible o de ec unexpec ed anomalies. Le us assume ha PCs in a local ne wo k should no communica e wi h each o he , excep o example wi h ins an messaging applica ion. Howe e , sys em de ec s Remo e Desk op P o ocol (RDP) communica ing wi hin se e al PCs, which should aise a wa ning. On he o he hand, RDP can also be used o legi asks, hus, by using i , an a ack can communica e unde ec ed o a long ime, in he case he de ec ion sys em alsely iden i ies i as alse nega i e. 3.5. P e iously Unknown A acks P e iously unknown a acks a e a common p oblem o adi ional de ec o s, such as in usion de ec ion sys ems (IDS), which a e based on a ack signa u es [ 11 ]. In he case o an APT, he p oblem is e en wo se, as he a ack uses sophis ica ed s eal h me hods and mimics no mal a ic and hus can hide unde ec ed o a long pe iods o ime [1,9]. Deep lea ning me hods ha e shown signi ican po en ial o de ec his ype o anomalies [5,11–22]. Albei s udied me hods a y om image p ocessing o signal p ocessing and so o h, basic unc ionali ies can be con e ed o ano he ype o de ec ion p ocess. 4. Deep Lea ning De ec ion S ack Fo esol ing he abo e-men ioned p oblems, we p opose a Deep Lea ning s ack ha uses sequen ial neu al ne wo ks o de ec ion and classi ica ion. Ou app oach also akes in o accoun de ec ion di e ences be ween algo i hms, ins ead o using a single algo i hm. Wi h his me hod, he s ack ex ac s p e iously known da a, de ec s anomalies, classi ies and does compa isons wi h his o ical ou lie s as well as seeks hei in e connec ions om ne wo k a ic low. Appl. Sci. 2019,9, 1055 4 o 10 4.1. Known A acks The pu pose o he i s laye is o de ec known a acks om da a low, sa e hem o da abase wi h imes amp and inally emo e he de ec ed da a om he low. The es o he da a low is pushed o he second de ec ion laye , acco ding o Figu e 1. The de ec ion accu acy is no 100 pe cen , hus e en when he known a acks a e emo ed, he e is a possibili y o exis ing aces o known a acks in he es o he da a. The i s laye includes mul iple neu al ne wo ks, which a e ained egula ly. Tha is, ins ead o using one neu al ne wo k ha is e- ained and upda ed, we add new neu al ne wo ks o he s ack, which a e ained wi h new ou lie de ec ions. This me hod is used o a oid o e i ing. Fo es ing and op imisa ion pu poses, we execu e es s wi h semi-supe ised (SDL) and unsupe ised (UDL) Deep Lea ning me hods in his laye . Neu al ne wo ks a e ained wi h da a om known a acks and, in he case he DL de ec s a known a ack, i d ops da a om low. Fo example, an Au oencode (AE) ha consis s o deep laye s can be ained only wi h known a acks, hus, when i de ec s a known a ack, i econs uc s he obse a ion co ec ly. In o he wo ds, all da a ha cause enough econs uc ion e o a e passed o he nex laye . He e is a mo e de ailed example how he i s and second de ec ion laye s a e e- ained and kep up o da e. We use he ollowing syn ax: xNy, whe e x ep esen s he assigned AE (1 o known a acks and 2 o no mal a ic) and y is he in e al numbe ha inc eases om 1 o n . To cla i y, when conside ing he i s and second laye s, he e a e coun o y unique AEs wi h hei own inpu and ou pu laye s. Tha is, he i s and second de ec ion laye s, as desc ibed in Figu e 1, do no include only one AE. Fi s , he aining in e al is se , 24 h in his example. Tha is, a new neu al ne wo k is ained e e y 24 h. The neu al ne wo k in he i s laye 1N1 is ained wi h a ailable da a o known a acks and he second laye ’s neu al ne wo k 2N1 wi h a ailable no mal a ic da a. The da a inpu om he i s day is es ed wi h 1N1 and 2N1 o anomalies. The i s and second laye ne wo ks o he second day a e ained wi h he da a p ocessed on he i s day, including he iden i ied a acks and upda ed no mal a ic. The da a inpu om he second day is p ocessed by 1N1 and 1N2 o known a acks as well as 2N1 and 2N2 o no mal a ic. The ne wo ks o he hi d day a e cons uc ed in he same ashion esul ing in h ee ne wo ks in he i s laye and h ee ne wo ks in he second laye o de ec ing known a acks and no mal a ic, espec i ely. In o he wo ds, each laye a e he i s one is ained wi h he de ec ions only om he p e ious laye . Wi h his a chi ec u e, he numbe o neu al ne wo ks inc eases depending on he aining in e al. I can be se o a day, week, mon h o some sui able alue. Fo example, when limi ing he maximum ime o ope a ion o he whole sys em o one yea and he aining in e al is one day, he numbe o neu al ne wo ks would be 365 in he i s and second laye s. Fo ime complexi y, his means ha he e would be 365 s anda d ime ope a ions in each laye , which could exclude eal- ime de ec ion. Howe e , i can be assumed ha de ec ion p ocess would no ake oo long ime. Wi h he desc ibed a chi ec u e, we can minimise he possibili y o o e i ing, which is impo an o neu al ne wo ks o be able o de ec anomalies. 4.2. No mal T a ic The second laye de ec s no mal ne wo k a ic and emo es i om he low. As he known a acks and no mal ne wo k a ic a e disca ded om he da a low, he e can s ill exis aces o p e iously unknown obse a ions in he es o he da a, which can be malicious. The second laye also con ains mul iple neu al ne wo ks. Howe e , when a new se ice o applica ion is ins alled o a ne wo k, he second laye should be upda ed acco dingly. These highly dynamical unc ionali ies in a ne wo k cause new ypes o da a, which inc eases he numbe o legi ou lie s. As in he ea lie laye , bo h SDL and UDL me hods a e es ed o op imal pe o mance. While he de ec ion p ocess s ays he same, he neu al ne wo ks a e ained only wi h no mal a ic da a. When Appl. Sci. 2019,9, 1055 5 o 10 conside ing he AE, he ou lie s ha a e causing econs uc ion e o a e passed o he nex laye and he da a ha a e success ully econs uc ed a e d opped om he low. 4.3. His o ical Appea ance The pu pose o he hi d laye is o de ec i an ou lie has appea ed ea lie in he ne wo k. Since APT can s ay in ine ia-s a e o a long pe iod o ime o a oid de ec ion, his o ical appea ance e i ica ion is impo an o he p ocess. The hi d laye is kep up o da e by e- aining he neu al ne wo k wi h he ou lie s ha ha e passed h ough he de ec ion p ocess. The hi d laye de ec s using Recu en Neu al Ne wo k—Long Sho -Te m Memo y (RNN-LSTM) uni s whe he an ou lie has appea ed be o e. While RNN can lea n empo al pa e ns and alues ha a e es ima ed om cu en and pas alues, i s memo y unc ion is sho . RNN-LSTM adds a cell o RNN enabling longe memo y ha has he abili y o lea n hese pa e ns om longe sequences o da a, hus imp o ing pe o mance and allowing be e ime-se ies es ima ion [20]. IP/TCP packe is cons uc ed om 27 unique ields, hus each ield is ea ed as a unique ea u e and all 27 ea u es a e passed h ough neu al ne wo k, while compa ing o ea lie ea u es. The neu al ne wo k is ained wi h ea lie ou lie s, which allows he neu al ne wo k o compa e 27 ea u es simul aneously and p edic ea lie appea ance. We can hink ea u es as signal agmen s, ha is p e iously ound ou lie s c ea e some ype o con inuous signals and hese signals can be isualised a e wa ds. One app oach o iden i y new ou lie s in signals is o de ec change poin s in signals [ 13 ]. Howe e , we canno assume ha a new ou lie , in any o he 27 signals, c ea es a de ec able change poin , as signals do no necessa ily beha e egula ly in ou case. Vinayakuma e al. s a ed ha anomalous e en s do no ha e pa e ns and hey occu equen ly in a ne wo k in en ionally o unin en ionally [ 20 ]. F om his pe spec i e, we can conside known ou lie s as no mal and new ou lie s as anomalies, while seeking hose om ou lie da a low. Qin e al. es ed RNN-LSTM o anomaly de ec ion in IP bea e ne wo k by ga he ing da a om 31,000 po s wi h highe han 1Gb/s a ic. A e aining he sys em o one week, hey managed o ge good anomaly de ec ion a es in a es en i onmen o 824 po s. They conside ed h ee ypes o anomalies: (i) wa ning, one anomaly do ; (ii) issue, wo con inuous anomaly do s; and (iii) ala m, mo e con inuous anomaly do s. Howe e , hey s a ed ha ixed he one-week moni o ing pe iod caused many alse posi i es, as a ic in po le el is no so pe iodical. Ano he conce n was compu ing usage while using RNN-LSTM in each po o es en i onmen , as i uses a lo o compu ing powe [ 16 ], hus we ha e o conside one o mo e sequen ial RNN-LSTMs, no pa allel. 4.4. Ou lie Classi ica ion The ou h laye classi ies ou lie s o di e en ca ego ies, which include a leas he ollowing: (i) known a acks; (ii) p edic ed a acks; (iii) unknown ou lie s; and (i ) no mal a ic. A e he classi ica ion p ocess, unnecessa y ou lie s can be emo ed om da a, ha is Ca ago ies (i) and (i ). The e a e di e en me hods o classi ying ou lie s. Zolo ukhin e al. p oposed [ 11 ] a me hod u ilising G owing Hie a chical Sel -O ganising Map (GHSOM) o de ec ing anomalies in dynamical web eques s o web-se e . The pu pose is o iden i y anomalies caused by misuse ha do no ha e signa u es. Tes esul s show high de ec ion a e wi h e y low alse posi i e a e, hus a simila app oach is used as a pa o ou me hod. Unsupe ised GHSOM allows he sel -o ganising map o g ow ho izon ally and e ically by using mul iple laye s. This way i c ea es highe a iance and de ec s smalle di e ences among ou lie s. To suppo he usage o GHSOM in ou me hod, Chiu e al. s a ed ha 2D Sel -O ganising Map (SOM) has wo disad an ages: (i) map size has o be de ined be o e aining p ocess; and (ii) he e a e no hie a chical ela ions be ween clus e s. Thei es esul s also show low alse posi i e and nega i e a es [ 12 ]. The e o e, we do no limi he clus e expansions o he GHSOM size, as he e does no exis any in o ma ion on how many clus e s should be chosen o how high o wide he GHSOM should g ow. Howe e , Shi e al. s a ed ha “ he hie a chical g owing Appl. Sci. 2019,9, 1055 6 o 10 mechanism o GHSOM is aul y” and p oposed sGHSOM wi h mino addi ional unc ionali y o sol e his issue. They added a new pa ame e o calcula e simila i y o classes by using a dis ance me ic be ween laye s, which is missing om GHSOM. Thei benchma king es s show inc eased classi ica ion accu acy compa ed o GHSOM [19], hus sGHSOM has o be e alua ed as well. 4.5. Anomaly Mapping The inal phase o he de ec ion p ocess is mapping anomalies, whe e hei in e connec ions a e analysed wi h a g aph algo i hm. The pu pose o his laye is o map ou lie s and e eal hei hidden connec ions, which may emain in isible o he wise. The e a e wo possible solu ions o his phase, ei he using G aph Da abase (GDB) o G aph-based Neu al Ne wo k (GNN) implemen a ion ha inds spa ial, empo al and seman ic ela ionships be ween da a poin s. Zhang [ 22 ] p oposed GDB o knowledge managemen in his esea ch. GDB is used o e eal connec ions among use c ea ed documen s and how hey a e used. Da a om ela ional da abase a e easily con e ed o GDB and connec ions made isible. The au ho s a ed h ee bene i s o using GDB: (i) hey a e ideal o modelling scena ios in a ne wo k; (ii) many- o-many ela ionships a e easy o implemen ; and (iii) quick access o da a wi h simple que ies. Hu lbu [ 14 ] s a ed ha , as GDBs deals wi h p ope ies and connec ions, hey ep esen a lo o in o ma ion, which s ays hidden wi hou esea ch. I is also poin ed ou ha GDB suppo s desc ibing all kinds o complex mode n ne wo ks. Mo eo e , Yisong [ 21 ] e al. s a ed ha da a in eg a ed ia GDB can s o e ne wo k opology di ec ly, hus i suppo s highly complex ne wo k p esen a ions. GNN, as p esen ed by Sca selli e al., is a gene al class neu al ne wo k o g aphs, which is p oposed o seek unde lying ela ionships among da a [ 18 ]. Qi e al. s a ed ha GNN “is a dynamic model whe e he hidden ep esen a ion o all nodes e ol e o e ime” [ 15 ]. Quek e al. used GNN o s udy s uc u al image p esen a ion and classi ica ion. They s a ed ha GNN is capable o p ocessing bo h posi ional and non-posi ional g aphs. Thei expe imen al es s show ha GNN has g ea po en ial o classi ying da a [ 17 ]. In GNNs, edges ep esen ela ionships, while nodes ep esen objec s o concep s [ 15 , 17 , 18 ]. Thus, we can s a e ha , o ou pu poses, nodes ep esen de ices and hei p ope ies in a ne wo k and edges connec ions be ween he nodes. 5. De ec ion Engine The pu pose o he p oposed me hod is o p ocess ou lie s as well as o de ec and iden i y APT a acks. Fo his pu pose, we de ine da a low as ollows: F=da a low K=known a acks N=no mal a ic O1=unknown legi ima e ou lie s O2=unknown a ack ou lie s KT= aces o known a acks NT= aces o no mal a ic F={K,N,O1,O2} The i s and second laye s emo e known da a. Howe e , as men ioned he Sec ions 4.1 and 4.2, ou lie da a can s ill con ain aces o known a acks and no mal a ic. A e he i s laye , he da a low is: F1={KT,N,O1,O2} Appl. Sci. 2019,9, 1055 7 o 10 A e he second laye , i is: F2={KT,NT,O1,O2} His o ical e en s a e es ed wi h RNN-LSTM whe e ou lie ea u es low h ough i . I he e is no ea lie de ec ion, i is a new ou lie . When an ou lie is de ec ed in his phase, i is added o he da abase. Then, his in o ma ion becomes a ailable o he classi ie . The classi ie o ganises ou lie s o he clus e s in GHSOM, based on da a packe s. As GHSOM does no limi he g ow h, wecan de ec sligh di e ences in ou lie s. I can iden i y new ypes o clus e s i hey appea in da a, since i is an unsupe ised me hod. A e wa ds, ou lie s a e mapped wi h a g aph me hod, which e eals hei hidden in e connec ions. These hidden connec ions can e eal how widely he APT has sp ead and which a e he communica ion p o ocols and po s. In he case an a ack uses in e nal ou ing communica ion channel, i can also be acked. The las phase is da a usion, whe e ou lie da a a e mapped in such ha hey can be isualised o in es iga ion and analysis pu poses. Fo he inal es s, he e a e ou di e en s ack models as desc ibed in Table 1. Table 1. S ack models o inal es s. 1s laye SDL SDL UDL UDL 2nd laye SDL UDL SDL UDL 3 d laye RNN-LSTM RNN-LSTM RNN-LSTM RNN-LSTM 4 h laye GHSOM GHSOM GHSOM GHSOM 5 h laye GNN/GDB GNN/GDB GNN/GDB GNN/GDB 6. Complexi y E alua ion The me hod’s complexi y is discussed in his sec ion. I is necessa y o e alua e he complexi y om wo poin s o iew, sys em and ime complexi ies. As hese complexi ies ha e signi ican impac on compu a ional equi emen s, hey ha e o be e alua ed in o de o assess whe he he sys em pe o ms in easonable ime. By e alua ions, we can es ima e minimum ha dwa e equi emen s and expec ed maximum ime o da a packe o pass en i e de ec ion p ocess. The sys em has a main unc ion, which is anomaly de ec ion and suppo ing unc ions, such as egula upda es, isualisa ion, w i ing o da abase and so o h. To keep in mind he pu pose o he esea ch, we ocus on anomaly de ec ion complexi y. Suppo ing unc ions can be execu ed in sepa a ed co es, hus hey do no in e e e wi h he de ec ion p ocess. Figu e 1shows da a low h ough he DL de ec ion s ack in a gene al le el. 6.1. Sys em Complexi y F om he low cha in Figu e 1, we can iden i y ha he complexi y o he sys em is inc easing owa ds he end o he s ack. The i s wo laye s a e simple and linea while emo ing known da a om a low; e en hough he e can exis 1–nneu al ne wo ks, he ope a ion emains simila in e e y neu al ne wo k. The inal laye s inc ease he complexi y as ou lie s a e pushed o h ee di e en ypes o neu al ne wo ks, each ha ing a special pu pose, as desc ibed abo e. A e ou lie s a e p ocessed in each neu al ne wo k, da a usion is execu ed o a ange da a in such manne ha hey can be p esen ed o isualised. The sou ce code is equi ed o de ailed Cycloma ic complexi y e alua ion, hus i can be execu ed when he comple e p o o ype is de eloped. Appl. Sci. 2019,9, 1055 8 o 10 Figu e 1. Da a low h ough he de ec ion p ocess.