Home TraceX: Early-stage advanced persistent threat detection framework using semantic network traffic analysis

Publications

TraceX: Early-stage advanced persistent threat detection framework using semantic network traffic analysis

Year : 2026

Publisher : Elsevier B.V.

Source Title : Computer Networks

Document Type :

Abstract

Advanced persistent threat (APT) is one of the most sophisticated cyberattacks to gain unauthorized access to a network and ex-filtrate sensitive data from organizations. Detecting APT is challenging because attackers are continuously changing and evolving their techniques to compromise the system. Besides this, the traditional malware detection techniques identify the presence of APT at the final stage or after it pass through different stages causing damage to the system. This work proposes an APT detection framework, named TraceX to detect the attack at its early stage. TraceX, extracts semantic information (APT malware behaviour) obtained from network traffic. The early-stage APT detector is fine-tuned on MITRE attack-data prepared from the MITRE ATT&CK Enterprise Matrix and automatically correlates with the extracted semantic information to detect APT at the early-stage efficiently. We comprehensively evaluate the performance of TraceX using several benchmark datasets with APT, including DAPT 2020, SE-CIC-IDS2018, and CICIDS2017. TraceX could successfully detect 71.38% of APT samples (2457 out of 3442) by the Internal Reconnaissance stage. The experimental results demonstrate that our approach outperforms current state-of-the-art detection methods.