Stacking Ensemble APT Identification Using Behavioral Feature Screening
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current APT organization identification methods rely heavily on manual analysis by experts, are inefficient for large numbers of samples, and struggle with obfuscation and packing techniques, leading to ineffective identification of APT attacks.
Innovation Solution
An APT organization identification method using a stacking ensemble, combining TF-IDF with n-gram to extract behavior features, followed by feature selection and multi-model fusion to improve accuracy and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual analysis by experts is used for APT organization identification, then identification accuracy may be maintained, but processing efficiency deteriorates significantly
Solution Approach 1:
The patent replaces manual expert analysis with an automated machine learning system. The stacking ensemble model automatically extracts features, performs classification, and identifies APT organizations without human intervention, thereby maintaining accuracy while dramatically improving processing efficiency and scalability.
Solution Approach 2:
The system performs self-service through automated feature extraction and classification. The stacking ensemble model independently processes malware samples, extracts behavioral features, and identifies organizations without requiring expert input, enabling the system to handle large volumes of samples autonomously.
2Productivity
If static API function features are used for automatic identification, then processing speed improves, but feature extraction becomes difficult due to obfuscation and packing
Solution Approach 1:
The patent transitions from static API function analysis to dynamic behavioral feature extraction. The system executes malware samples and captures their runtime behavior, system calls, and interaction patterns, making the analysis adaptive to obfuscation and packing techniques that obscure static code structure.
Solution Approach 2:
The patent introduces dynamic execution and behavioral monitoring as an intermediary between the malware sample and the analysis system. Instead of directly analyzing obfuscated code, the system observes the behavioral footprint left during execution, which remains visible even when code structure is obfuscated or packed.
3Measurement precision
If correlation analysis of malicious code structure is used, then identification can be performed, but the method is time-consuming and cannot meet needs for large numbers of samples
Solution Approach 1:
The patent performs preliminary feature extraction and transformation into a standardized representation before classification. By pre-processing and encoding behavioral features into a compact format, the system reduces the computational burden during identification, enabling rapid processing of large numbers of samples without sacrificing identification capability.
Data Source
AI summary
An APT organization identification method, system and storage medium based on a stacking ensemble are provided, the method comprising: using a TF-IDF algorithm combined with an n-gram to extract and vectorize behavior features from malware samples to form a malicious behavior vector feature set; based on the malicious behavior vector feature set, calculating correlations between features and chi-square values between the features and categories, performing screening twice on the malicious behavior vector feature set to obtain an improved low-dimensional feature subset data; constructing a multi-model fusion stacking ensemble, learning an APT organization identification model, using the APT organization identification model to perform an identification on new ATP attacks. The feature selection of high-dimensional behavior vector features reduces the complexity of the data set; the imbalance of samples in the data set is also considered, and multi-model integrated training to improve the recognition accuracy is adopted; in addition, the APT organization identification model for malicious samples is obtained through machine learning training, which improves the automatic identification efficiency of new sample is improved.