Advancing APT detection through transformer-driven feature learning and synthetic data generation

Abstract

Abstract Advanced Persistent Threat (APT) detection based on artificial intelligence (AI) platforms has emerged as a dominant trend, has attracted increasing attention in cybersecurity. Nevertheless, two major challenges remain: (i) how to effectively extract discriminative features from complex network traffic flows, and (ii) how to address severe class imbalance caused by the rarity of APT attacks. To tackle these challenges, we propose an integrated pipeline/framework named ET-SDG. The ET-SDG model integrates Transformer-based Feature Learning with a Conditional Generative Model for Synthesis (CGMS). Specifically, the Transformer-based feature learning component combines the ExtraTrees algorithm with a Transformer architecture to select, aggregate, and encode informative flow-level features. To mitigate data imbalance, ET-SDG incorporates CGMS, a cGAN-based synthetic data generation module designed for data augmentation of minority APT traffic. By conditioning the generation process on class labels, CGMS synthesizes representative minority-class samples, aiming to improve the robustness and generalization of the downstream detection model under class imbalance. Across the evaluated benchmarks, ET-SDG shows competitive results and provides modest improvements (approximately 1–4% points, depending on the dataset and metric) relative to the compared baselines.