DeepTaskAPT: Insider APT detection using Task-tree based Deep Learning
Open accessAbstract
APT, known as Advanced Persistent Threat, is a difficult challenge for cyber defence. These threats make many traditional defences ineffective as the vulnerabilities exploited by these threats are insiders who have access to and are within the network. This paper proposes DeepTaskAPT, a heterogeneous task-tree based deep learning method to construct a baseline model based on sequences of tasks using a Long Short-Term Memory (LSTM) neural network that can be applied across different users to identify anomalous behaviour. Rather than applying the model to sequential log entries directly, as most current approaches do, DeepTaskAPT applies a process tree based task generation method to generate sequential log entries for the deep learning model. To assess the performance of DeepTaskAPT, we use a recently released synthetic dataset, DARPA Operationally Transparent Computing (OpTC) dataset and a real-world dataset, Los Alamos National Laboratory (LANL) dataset. Both of them are composed of host-based data collected from sensors. Our results show that DeepTaskAPT outperforms similar approaches e.g. DeepLog and the DeepTaskAPT baseline model demonstrate its capability to detect malicious traces in various attack scenarios while having high accuracy and low false-positive rates. To the best of knowledge this is the very first attempt of using recently introduced OpTC dataset for cyber threat detection.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The effectiveness of heuristic-based insider threat detection relies heavily on the careful design and fine-tuning of the heuristics themselves.
“However, the effectiveness of heuristic-based insider threat detection relies heavily on the careful design and fine-tuning of the heuristics themselves as demonstrated in [42], [10], [61].”
From A Review of Recent Advances, Challenges, and Opportunities in Malicious Insider Threat Detection Using Machine Learning Methods (2024) · cites this paper as [42]
Cites
A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networks
Hendrycks, D., & Gimpel, K. (2016) · arXiv · doi:10.48550/arxiv.1610.02136 · Cited by 1,968 · see citing works
DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning
Du, M., Li, F., Zheng, G., & Srikumar, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134015 · Cited by 1,835 · see citing works
An experimental comparison of performance measures for classification
Ferri, C., Hernández-Orallo, J., & Modroiu, R. (2009) · Pattern Recognition Letters · doi:10.1016/j.patrec.2008.08.010 · Cited by 889 · see citing works
Robust log-based anomaly detection on unstable log data
Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., Xie, C., Yang, X., Cheng, Q., Li, Z., et al. (2019) · Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering · doi:10.1145/3338906.3338931 · Cited by 761 · see citing works
LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs
Meng, W., Liu, Y., Zhu, Y., Zhang, S., Pei, D., Liu, Y., Chen, Y., Zhang, R., Tao, S., Sun, P., et al. (2019) · Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/658 · Cited by 708 · see citing works
Likelihood Ratios for Out-of-Distribution DetectionPreprint
Ren, J., Liu, P. J., Fertig, E., Snoek, J., Poplin, R. E., DePristo, M. A., Dillon, J. V., & Lakshminarayanan, B. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1906.02845 · Cited by 407 · see citing works
Liu, F., Wen, Y., Zhang, D., Jiang, X., Xing, X., & Meng, D. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3363224 · Cited by 319 · see citing works
Mining invariants from console logs for system problem detection
Lou, J., Fu, Q., Yang, S., Xu, Y., & Li, J. (2010) · Cited by 301 · see citing works
An Introduction to Outlier Analysis
Aggarwal, C. C. (2016) · Springer eBooks · doi:10.1007/978-3-319-47578-3_1 · Cited by 296 · see citing works
HitAnomaly: Hierarchical Transformers for Anomaly Detection in System Log
Huang, S., Liu, Y., Fung, C., He, R., Zhao, Y., Yang, H., & Luan, Z. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.3034647 · Cited by 234 · see citing works
Towards Automated Log Parsing for Large-Scale Log Data Analysis
He, P., Zhu, J., He, S., Li, J., & Lyu, M. R. (2018) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2017.2762673 · Cited by 230 · see citing works
Detecting Malicious URLs Using Lexical Analysis
Mamun, M., Rathore, M. A., Lashkari, A. H., Stakhanova, N., & Ghorbani, A. A. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-46298-1_30 · Cited by 218 · see citing works
Self-citationAutomated IT system failure prediction: A deep learning approach
Zhang, K., Xu, J., Min, M. R., Jiang, G., Pelechrinis, K., & Zhang, H. (2016) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata.2016.7840733 · Cited by 187 · see citing works
One-Class Adversarial Nets for Fraud Detection
Zheng, P., Yuan, S., Wu, X., Li, J., & Lu, A. (2019) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v33i01.33011286 · Cited by 173 · see citing works
A review of threat modelling approaches for APT-style attacks
Tatam, M., Shanmugam, B., Azam, S., & Kannoorpatti, K. (2021) · Heliyon · doi:10.1016/j.heliyon.2021.e05969 · Cited by 120 · see citing works
Unified Host and Network Data Set
Turcotte, M., Kent, A. D., & Hash, C. (2018) · Security science and technology · doi:10.1142/9781786345646_001 · Cited by 114 · see citing works
An Introduction to Outlier Analysis
Aggarwal, C. C. (2012) · Springer eBooks · doi:10.1007/978-1-4614-6396-2_1 · Cited by 88 · see citing works
An Unsupervised Multi-Detector Approach for Identifying Malicious Lateral Movement
Bohara, A., Noureddine, M. A., Fawaz, A., & Sanders, W. H. (2017) · IEEE Symposium on Reliable Distributed Systems (SRDS) · doi:10.1109/srds.2017.31 · Cited by 70 · see citing works
Comprehensive, Multi-Source Cyber-Security Events Data Set
Kent, A. D. (2015) · OSTI OAI (U.S. Department of Energy Office of Scientific and Technical Information) · doi:10.17021/1179829 · Cited by 45 · see citing works
DeepAPT: Nation-State APT Attribution Using End-to-End Deep Neural Networks
Rosenberg, I., Sicard, G., & David, E. O. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-68612-7_11 · Cited by 40 · see citing works
Natural Language Processing: Speaker, Language, and Gender Identification with LSTM
Nammous, M. K., & Saeed, K. (2019) · Advances in intelligent systems and computing · doi:10.1007/978-981-13-3702-4_9 · Cited by 30 · see citing works
Tell Them from Me: An Encrypted Application Profiler
Mamun, M., Lu, R., & Gaudet, M. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-36938-5_28 · Cited by 3 · see citing works
Self-citation
Flagged first, then by citations
1 of the 23 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Alzaabi, F. R., & Mehmood, A. (2024) · IEEE Access · doi:10.1109/access.2024.3369906 · Cited by 204 · see citing works
“Conditional Generative Adversarial Networks (CGANs) has been applied in [42] to address the scarcity of real-world data and skewed class distribution.”
BackgroundSaini, N., Kasaragod, V. B., Prakash, K., & Das, A. K. (2023) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.7865 · Cited by 54 · see citing works
Advanced Persistent Threat intelligent profiling technique: A survey
Tang, B., Wang, J., Yu, Z., Chen, B., Ge, W., Yu, J., & Lu, T. (2022) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2022.108261 · Cited by 37 · see citing works
Saeed Alketbi, K., & Mehmood, A. (2025) · IEEE Access · doi:10.1109/access.2025.3587114 · Cited by 41 · see citing works
“Advanced language models such as RoBERTa provide deeper contextual understanding, but face limitations in scalability and linguistic ambiguity [11], [31].”
Nazari, H., Yazdinejad, A., Dehghantanha, A., Zarrinkalam, F., & Srivastava, G. (2023) · doi:10.1145/3689933.3690836 · Cited by 14 · see citing works
E-Audit: Distinguishing and investigating suspicious events for APTs attack detection
Patil, R. S., Muneeswaran, S., Sachidananda, V., & Gurusamy, M. (2023) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2023.102988 · Cited by 10 · see citing works
A Novel Approach for APT Detection Based on Ensemble Learning Model
Cương, N. H., Xuan, C. D., Long, V. T., Dat, N. D., & Anh, T. Q. (2025) · Statistical Analysis and Data Mining The ASA Data Science Journal · doi:10.1002/sam.70005 · Cited by 9 · see citing works
Cai, X., Zhang, H., Ahmed, C. M., & Koide, H. (2025) · IEEE Access · doi:10.1109/access.2025.3567772 · Cited by 7 · see citing works
Leveraging Token-Based Representation to Detect Lateral Movement
Liu, J., & Shi, J. (2023) · Asia-Pacific Conference on Image Processing, Electronics and Computers (IPEC) · doi:10.1109/ipec57296.2023.00074 · Cited by 5 · see citing works
Alzaabi, F. R., & Mehmood, A. (2024) · International Conference on Engineering and Emerging Technologies (ICEET) · doi:10.1109/iceet65156.2024.10913767 · Cited by 4 · see citing works
Priya, M. K. V., Glory, H. A., & Sriram, V. S. S. (2024) · Communications in computer and information science · doi:10.1007/978-981-97-9743-1_15 · Cited by 4 · see citing works
Ensemble learning-based adaptive and adversarial techniques for APT attack detection
Tùng, N. T., Xuan, C. D., & Long, V. T. (2025) · International Journal of Information Security · doi:10.1007/s10207-025-01053-9 · Cited by 3 · see citing works
Punith, R. M., & Priya, D. (2022) · International Journal for Research in Applied Science and Engineering Technology · doi:10.22214/ijraset.2022.45407 · Cited by 2 · see citing works
Malicious Cyber Activity Detection using Zigzag Persistence
Myers, A., Bittner, A., Aksoy, S. G., Best, D., Henselman‐Petrusek, G., Jenne, H., Joslyn, C., Kay, B., Seppala, G., Young, S. J., et al. (2023) · IEEE Conference on Dependable and Secure Computing (DSC) · doi:10.1109/dsc61021.2023.10354204 · Cited by 2 · see citing works
Effective IDS under constraints of modern enterprise networks: revisiting the OpTC dataset
Nikulshin, V., & Talhi, C. (2024) · Conference on Cloud and Internet of Things (CIoT) · doi:10.1109/ciot63799.2024.10757066 · Cited by 2 · see citing works
Building APT Malicious Attacker Profiles for Power Monitoring Systems with Machine Learning
Cao, Y., Su, Y., Guo, S., & Wang, H. (2023) · International Conference on Advanced Electrical and Energy Systems (AEES) · doi:10.1109/aees59800.2023.10469045 · Cited by 1 · see citing works
APT Attack Detection and Defense Techniques: A Review
Neelwarna, G., & Wagh, S. K. (2025) · International Conference on Circuits, Power and Intelligent Systems (CCPIS) · doi:10.1109/ccpis65231.2025.11233933 · Cited by 1 · see citing works
Mamun, M., & Buffett, S. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-15777-6_30 · Cited by 1 · see citing works
Self-citationYarovenko, G., Perkhun, L., Nebaba, N. A., Bulhakova, O., & Kostenko, V. (2023) · Actual Problems of Economics · doi:10.32752/1993-6788-2023-1-268-71-83
Detecting Advanced Persistent Threats on a Network Using Machine Learning
Francis, G., Sanan, M., Hatoum, M. W., Bakir, N., & Samrouth, K. (2024) · International Conference on Smart Systems and Power Management (IC2SPM) · doi:10.1109/ic2spm62723.2024.10841340
COMISET: Dataset for the analysis of malicious events in Windows systems
Pérez-Sánchez, A., Palacios, R., & López, G. (2025) · Data in Brief · doi:10.1016/j.dib.2025.111723
Using Graph With Interconnection Intervals Embedding to Discover Potential Threats in the Network
Hao, X., Liu, B., Sun, X., Cao, J., Zhou, D., & Fu, X. (2025) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2025.3582365
Synthetic Lateral Movement Data Generation for Azure Cloud: A Hopper-Based Approach
Mamun, M., Ahmed, H., Mabrouk, A., & Saad, S. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-4434-9_25
Self-citationHasan, B. F., Kassara, W. A., & Zahi, B. R. (2025) · Mesopotamian Journal of CyberSecurity · doi:10.58496/mjcs/2025/068
Opanovych, M. (2025) · Cybersecurity Education Science Technique · doi:10.28925/2663-4023.2025.30.915
Ebelogu, C. U., Musa, I., Abbah, E. U., Njoku, D. O., & Obadaki, O. R. (2026) · Engineering headway · doi:10.4028/p-mgos5t
Deep Learning (DL) for Advanced Persistent Threat (APT) Detection in Cybersecurity
Ahmed, S., Keerio, I. K., Jhatial, M. J., Usman, A., Qutaba, S., & Rasheed, A. (2026) · International Journal of Innovations in Science and Technology · doi:10.33411/ijist/1764
LMBE: Unsupervised Detection of Lateral Movement via User Behavior Embedding
Chen, Y., Zhao, C., Cheng, J., Li, X., Li, S., Han, D., Liu, Y., & Lü, Z. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-22542-9_11
CLASSIFICATION OF VISITORS AND IDENTIFYING INTRUDERS IN A NETWORK
Hejazi, N., & Ozdemır, E. (2026) · International Journal of Informatics and Applied Mathematics · doi:10.53508/ijiam.1780395
- Authors
- Mamun, M., & Shi, K.
- Affiliations
- National Research Council Canada (CA)
- Venue
- 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)
- Publisher
- IEEE
- Published
- 2021-10
- Pages
- 693-700
- OpenAlex
- W3196544260
- Cited by
- 29
- References
- 23
- Citations by year
- 2026: 4 · 2025: 10 · 2024: 5 · 2023: 7 · 2022: 3
- FWCI
- 3.47
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by-nc-nd)
- NPARC (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Keywords
- advanced persistent threats, insider threat detection, task trees, process trees, anomaly detection, host-based intrusion detection, LSTM
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
