Can Artificial Intelligence (AI) detect Advanced Persistent Threats?

This Q&A session follows a talk by Ankur Chowdhary on whether artificial intelligence can find Advanced Persistent Threat activity inside a network. The research collected traffic at the boundary between public and private networks, along with Snort alerts, host logs, DNS and web server logs, file server logs and storage system logs. About 84 features were extracted from this traffic and the host data, and the models worked on those features.

On the question of data bias, the speaker noted that APT campaigns can last for weeks or months, so the real signal is small compared with the volume of normal traffic. The team favored anomaly detection models, including one-class SVM, LSTM and stacked autoencoders, and evaluated them with precision rather than ROC curves, since false positive rates can skew results toward the wrong conclusions. Data was gathered over several days in phases: normal baseline traffic first, then reconnaissance, then foothold establishment, which made normal behaviour easier to separate from attack activity.

Questions also covered the risk of manipulation. Attackers can feed falsified data or probe a model to learn which features it uses, a research area known as adversarial attacks that this work did not address. For practitioners, the takeaways are that phased data collection and careful choice of evaluation metrics matter as much as the model itself, and that detection models should be checked for resistance to manipulation.