Machine Learning-Based Detection of Advanced Persistent Threats (APTs) in Large-Scale Computer Networks: A Comprehensive Review

Abstract

Advanced Persistent Threats (APTs) represent one of the most sophisticated paradigms of cyber attacks targeting modern enterprise infrastructures and large-scale computer networks. Characterized by a multi-stage lifecycle, low and-slow execution cadence, usage of legitimate system binaries (Living-off the-Land), and zero-day exploits, APTs easily evade signature-based intrusion detection systems. To counteract these stealthy threat actors, machine learning (ML) and deep learning (DL) techniques have emerged as indispensable tools for behavioral network monitoring. This paper provides a comprehensive review of machine learning methodologies for APT detection. We systematically analyze the APT lifecycle—from initial access to data exfiltration—and map these phases to supervised, unsupervised, semi supervised, and graph-based deep learning models. Furthermore, we evaluate benchmark datasets (CIC-AWS-2018, UNSW-NB15, DARPA-OpTC), feature engineering pipelines, data imbalance strategies, concept drift adaptation, and Explainable AI (XAI) frameworks for forensic interpretation. Finally, strategic research directions including federated learning and zero-trust security integration are presented.

KEYWORDS: Advanced Persistent Threats (APTs), Machine Learning, Network Security, Deep Learning, Graph Neural Networks, Threat Intelligence, Intrusion Detection Systems.