Can Artificial Intelligence (AI) Detect Advanced Persistent Threats?

The talk asks whether AI-based products can actually detect advanced persistent threats, the slow and stealthy intrusions carried out by well-funded groups over long periods. The speaker explains why signature-based tools struggle with them and walks through the usual APT stages: reconnaissance, initial foothold, lateral movement, and exfiltration, with log deletion as a final step. Case studies such as the Equifax breach and a Hydra exploit show how these campaigns unfold in practice.

To test detection models, the research team built the DAPT 2020 dataset from packet captures of staged attacks run against a network of deliberately vulnerable virtual machines. Normal user activity was generated alongside the attacks, so attack traffic made up only a small share of the data, and a red team carried out each phase on separate days. The team compared semi-supervised models, including one-class SVM, stacked autoencoders, and an LSTM variant, using precision-recall and ROC metrics. Results varied widely across phases and datasets, and the models performed poorly on lateral movement and exfiltration.

The main takeaway is that reported accuracy figures can hide weak coverage of the attack lifecycle, since many existing datasets omit later stages. The speaker argues that better models are needed, ones that capture time-based context across the phases of an intrusion, and points to the public DAPT 2020 dataset as a starting point for fair evaluation.