APTSniffer: Detecting APT Attack Traffic Using Retrieval-Augmented Large Language Models

Hongbo Xu; Chengxiang Si; Zhou Zhou; Chenxu Wang; Peishuai Sun; Qingyun Liu

ICASSP 2025accepted0 citations

APTSniffer: Detecting APT Attack Traffic Using Retrieval-Augmented Large Language Models

Hongbo Xu, Chengxiang Si, Zhou Zhou, Chenxu Wang, Peishuai Sun, Qingyun Liu

Abstract

Advanced Persistent Threats (APT) differ from traditional attacks by using more complex and covert strategies for long-term assaults, posing a severe threat to organizational and national security. Due to problems like the shortage of APT traffic data and encrypted traffic obfuscation, existing methods cannot accurately identify APT traffic with just a few traffic samples. To overcome the above limitation, we propose a novel encrypted APT traffic detection model, APTSniffer, which combines large language models (LLM) and retrieval-augmented technology. APTSniffer utilizes the few-shot inference and generalization abilities of large language models by converting raw traffic data into natural language inference examples understandable by the LLM. Experimental results show that, compared to other baseline models, APTSniffer exhibits SOTA performance. It achieves F1 scores above 97% on three APT datasets, making it practically applicable for APT traffic detection tasks.

BibTeX

@inproceedings{icassp2025_aptsnifferdetect,
  title = {APTSniffer: Detecting APT Attack Traffic Using Retrieval-Augmented Large Language Models},
  author = {Hongbo Xu and Chengxiang Si and Zhou Zhou and Chenxu Wang and Peishuai Sun and Qingyun Liu},
  booktitle = {ICASSP 2025},
  year = {2025}
}