Research on APT Attack Behavior Tracing Method Based on Deep Neural Network

Abstract

Advanced Persistent Threat (APT) attack tracing aims to identify attack behavior patterns and trace the attack source, which is a key step in security operations and incident response. To address the difficulties of multi-type attack behavior identification and severe class imbalance, this paper proposes an APT attack behavior tracing method based on a Deep Neural Network (DNN). Based on the public UNSW-NB15 network traffic dataset, network behaviors are divided into 10 categories, namely normal behavior and 9 types of attack behaviors. Through data cleaning, categorical feature encoding, and numerical standardization, a 70-dimensional feature sample set is constructed, and a multilayer perceptron network is employed to perform fine-grained classification of attack behaviors; the identification results are then mapped to APT kill-chain stages to assist attacker profiling and attribution. The proposed method is compared with XGBoost, linear support vector machine, AdaBoost, and random forest. Experimental results show that XGBoost achieves the best macro-averaged F1 of 0.5160, while the proposed DNN ranks second with a macro-averaged F1 of 0.4600; both significantly outperform the linear model and AdaBoost. Per-class analysis reveals that majority attack behaviors are identified with high accuracy, whereas minority classes such as Analysis and Backdoor are difficult to recognize, indicating that class imbalance is the main factor limiting tracing performance. A further oversampling ablation experiment shows that simple resampling cannot effectively improve minority-class identification, and more sophisticated cost-sensitive or semantic enhancement strategies are needed. This study provides a reproducible experimental reference for APT attack behavior tracing and attribution assistance.