Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Identifying Tactics of Advanced Persistent Threats with Limited Attack Traces



Khandakar Ashrafi Akbar, Yigong Wang, Md Islam, Anoop Singhal, Latifur Khan, Bhavani Thuraisingham1


The cyberworld being threatened by continuous imposters needs the development of intelligent methods for identifying threats while keeping in mind all the constraints that can be encountered. Advanced persistent threats (APT) have become an emerging issue nationwide, in international, and commercial aspects, that secretly steals information and keeps track of system processes over a long period of time. Depending on the objective, adversaries use different tactics throughout the APT campaign to compromise the systems. Therefore, this kind of attack needs immediate attention as such attack tactics are hard to detect for being interleaved with benign activities. Moreover, existing solutions to detect APT attacks are computationally expensive since keeping track of every system behavior is both costly and challenging. In addition, because of the data imbalance issue that appears due to few malicious events compared to the innumerable benign events in the system, the performance of the existing detection models is affected. In this work, we propose novel machine learning (ML) approaches to classify such attack tactics. We convert APT traces into a graph, generate nodes, and eventually graph embeddings, and classify using ML. For ML, we use proposed advanced approaches to address class imbalance issues and compare our approaches with other baseline models and show the effectiveness of our approaches.
Proceedings Title
International Conference on Information System Security ICISS 2021
Conference Dates
December 16-20, 2021
Conference Location
Patna, MD, US


Advanced Persistent Threat, Online Metric Learning, Data Imbalance


Akbar, K. , Wang, Y. , Islam, M. , Singhal, A. , Khan, L. and Thuraisingham1, B. (2021), Identifying Tactics of Advanced Persistent Threats with Limited Attack Traces, International Conference on Information System Security ICISS 2021, Patna, MD, US, [online],, (Accessed June 14, 2024)


If you have any questions about this publication or are having problems accessing it, please contact

Created December 16, 2021, Updated November 29, 2022