Hybrid Ensemble and Deep Learning Architectures for Advanced Persistent Threat Detection

This paper examines classical machine learning (ML) and deep learning (DL) models for advanced persistent threat (APT) detection, with a focus on hybrid ensemble configurations. We propose multi-stage hybrid ensemble ML models. Simulation results demonstrate that hybrid ensemble models outperform single classifiers by leveraging model diversity and complementary decision-making to capture complex attack patterns. DL architectures, particularly convolutional long short-term memory (CNN-LSTM), further surpass traditional ML models by learning hierarchical features and temporal dependencies in the network traffic. To address the scarcity of real-world APT datasets, we constructed an APT-aware dataset from UNSW-NB15 and evaluated it across multiple learning paradigms. The results highlight improved adaptability to evolving APT tactics and bridge the gap between generic intrusion detection and specialized APT detection through life-cycle-aware modeling.