A Hybrid Feature Selection Method for Advanced Persistent Threat Detection

Khalid, Adam and Zainal, Anazida and Ghaleb, Fuad A. and Ali Saleh Al-rimy, Bander and Ahmed, Yussuf (2025) A Hybrid Feature Selection Method for Advanced Persistent Threat Detection. Computers, Materials and Continua. ISSN 1546-2218

Preview

Text TSP_CMC_63451.pdf - Published Version Available under License Creative Commons Attribution. Download (1MB)

Abstract

Advanced Persistent Threats (APTs) represent one of the most complex and dangerous categories of cyber-attacks characterised by their stealthy behaviour, long-term persistence, and ability to bypass traditional detection systems. The complexity of real-world network data poses significant challenges in detection. Machine learning models have shown promise in detecting APTs; however, their performance often suffers when trained on large datasets with redundant or irrelevant features. This study presents a novel, hybrid feature selection method designed to improve APT detection by reducing dimensionality while preserving the informative characteristics of the data. It combines Mutual Information (MI), Symmetric Uncertainty (SU) and Minimum Redundancy Maximum Relevance (mRMR) to enhance feature selection. MI and SU assess feature relevance, while mRMR maximises relevance and minimises redundancy, ensuring that the most impactful features are prioritised. This method addresses redundancy among selected features, improving the overall efficiency and effectiveness of the detection model. Experiments on a real-world APT datasets were conducted to evaluate the proposed method. Multiple classifiers including, Random Forest, Support Vector Machine (SVM), Gradient Boosting, and Neural Networks were used to assess classification performance. The results demonstrate that the proposed feature selection method significantly enhances detection accuracy compared to baseline models trained on the full feature set. The Random Forest algorithm achieved the highest performance, with near-perfect accuracy, precision, recall, and F1 scores (99.97). The proposed adaptive thresholding algorithm within the selection method allows each classifier to benefit from a reduced and optimised feature space, resulting in improved training and predictive performance. This research offers a scalable and classifier-agnostic solution for dimensionality reduction in cybersecurity applications.

Item Type:	Article
Identification Number:	10.32604/cmc.2025.063451
Dates:	Date Event 25 June 2025 Accepted 8 July 2025 Published Online
Uncontrolled Keywords:	Advanced persistent threats, hybrid-based techniques, feature selection, data processing, symmetric uncertainty, mutual information, minimum redundancy, APT detection
Subjects:	CAH11 - computing > CAH11-01 - computing > CAH11-01-01 - computer science
Divisions:	Faculty of Computing, Engineering and the Built Environment > College of Computing
Depositing User:	Gemma Tonks
Date Deposited:	09 Jul 2025 12:59
Last Modified:	09 Jul 2025 12:59
URI:	https://www.open-access.bcu.ac.uk/id/eprint/16509

Actions (login required)

View Item