# A Study on the Importance of Features in Detecting Advanced Persistent Threats Using Machine Learning

arXiv: https://arxiv.org/abs/2502.07207 · HTML: https://mlsanity.com/paper/2502.07207/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 28 references that are in the map.
- First posted on arXiv 11 Feb 2025.

## Builds on (most cited first, 6 of 6)

- [Concrete Autoencoders for Differentiable Feature Selection and Reconstruction](https://mlsanity.com/paper/1901.09346/) (2019)
- [Learning to Maximize Mutual Information for Dynamic Feature Selection](https://mlsanity.com/paper/2301.00557/) (2023)
- [A Dynamic Games Approach to Proactive Defense Strategies against Advanced Persistent Threats in Cyber-Physical Systems](https://mlsanity.com/paper/1906.09687/) (2019)
- [Malware triage for early identification of Advanced Persistent Threat activities](https://mlsanity.com/paper/1810.07321/) (2018)
- [Blockchain based AI-enabled Industry 4.0 CPS Protection against Advanced Persistent Threat](https://mlsanity.com/paper/2201.12727/) (2022)
- [Investigation of Cyber Attacks on a Water Distribution System](https://mlsanity.com/paper/1906.02279/) (2019)

## Abstract (arXiv)

Advanced Persistent Threats (APTs) pose a significant security risk to organizations and industries. These attacks often lead to severe data breaches and compromise the system for a long time. Mitigating these sophisticated attacks is highly challenging due to the stealthy and persistent nature of APTs. Machine learning models are often employed to tackle this challenge by bringing automation and scalability to APT detection. Nevertheless, these intelligent methods are data-driven, and thus, highly affected by the quality and relevance of input data. This paper aims to analyze measurements considered when recording network traffic and conclude which features contribute more to detecting APT samples. To do this, we study the features associated with various APT cases and determine their importance using a machine learning framework. To ensure the generalization of our findings, several feature selection techniques are employed and paired with different classifiers to evaluate their effectiveness. Our findings provide insights into how APT detection can be enhanced in real-world scenarios.