A Lightweight IDS for Early APT Detection Using a Novel Feature Selection Method

Bassam Noori Shaker, Bahaa Al-Musawi, Mohammed Falih Hassan · Jun 13, 2025 · Citations: 0

Abstract

An Advanced Persistent Threat (APT) is a multistage, highly sophisticated, and covert form of cyber threat that gains unauthorized access to networks to either steal valuable data or disrupt the targeted network. These threats often remain undetected for extended periods, emphasizing the critical need for early detection in networks to mitigate potential APT consequences. In this work, we propose a feature selection method for developing a lightweight intrusion detection system capable of effectively identifying APTs at the initial compromise stage. Our approach leverages the XGBoost algorithm and Explainable Artificial Intelligence (XAI), specifically utilizing the SHAP (SHapley Additive exPlanations) method for identifying the most relevant features of the initial compromise stage. The results of our proposed method showed the ability to reduce the selected features of the SCVIC-APT-2021 dataset from 77 to just four while maintaining consistent evaluation metrics for the suggested system. The estimated metrics values are 97% precision, 100% recall, and a 98% F1 score. The proposed method not only aids in preventing successful APT consequences but also enhances understanding of APT behavior at early stages.

HFEPX Relevance Assessment

This paper appears adjacent to HFEPX scope (human-feedback/eval), but does not show strong direct protocol evidence in metadata/abstract.

Eval-Fit Score

0/100 • Low

Treat as adjacent context, not a core eval-method reference.

Human Feedback Signal

Not explicit in abstract metadata

Evaluation Signal

Detected

HFEPX Fit

Adjacent candidate

If you are doing eval pipeline work, start here:

Human Eval Hub LLM-as-Judge Hub Pairwise Preference Hub Tool-Use Eval Hub

Human Data Lens

Uses human feedback: No
Feedback types: None
Rater population: Unknown
Unit of annotation: Unknown
Expertise required: General
Extraction source: Persisted extraction

Evaluation Lens

Evaluation modes: Automatic Metrics
Agentic eval: None
Quality controls: Not reported
Confidence: 0.35
Flags: low_signal, possible_false_positive

Protocol And Measurement Signals

Benchmarks / Datasets

No benchmark or dataset names were extracted from the available abstract.

Reported Metrics

f1precisionrecall

Research Brief

Deterministic synthesis

In this work, we propose a feature selection method for developing a lightweight intrusion detection system capable of effectively identifying APTs at the initial compromise stage. HFEPX signals include Automatic Metrics with confidence 0.35. Updated from current HFEPX corpus.

Generated Mar 4, 2026, 1:32 PM · Grounded in abstract + metadata only

Key Takeaways

In this work, we propose a feature selection method for developing a lightweight intrusion detection system capable of effectively identifying APTs at the initial compromise stage.
The results of our proposed method showed the ability to reduce the selected features of the SCVIC-APT-2021 dataset from 77 to just four while maintaining consistent evaluation…

Researcher Actions

Treat this as method context, then pivot to protocol-specific HFEPX hubs.
Identify benchmark choices from full text before operationalizing conclusions.
Validate metric comparability (f1, precision, recall).

Caveats

Generated from title, abstract, and extracted metadata only; full-paper implementation details are not parsed.
Low-signal flag detected: protocol relevance may be indirect.

Recommended Queries

human-eval protocol design pairwise preference data quality inter-rater agreement adjudication

Research Summary

Contribution Summary

In this work, we propose a feature selection method for developing a lightweight intrusion detection system capable of effectively identifying APTs at the initial compromise stage.
The results of our proposed method showed the ability to reduce the selected features of the SCVIC-APT-2021 dataset from 77 to just four while maintaining consistent evaluation metrics for the suggested system.
The estimated metrics values are 97% precision, 100% recall, and a 98% F1 score.

Why It Matters For Eval

The results of our proposed method showed the ability to reduce the selected features of the SCVIC-APT-2021 dataset from 77 to just four while maintaining consistent evaluation metrics for the suggested system.

Researcher Checklist

Gap: Human feedback protocol is explicit

No explicit human feedback protocol detected.
Pass: Evaluation mode is explicit

Detected: Automatic Metrics
Gap: Quality control reporting appears

No calibration/adjudication/IAA control explicitly detected.
Gap: Benchmark or dataset anchors are present

No benchmark/dataset anchor extracted from abstract.
Pass: Metric reporting is present

Detected: f1, precision, recall

Category-Adjacent Papers (Broader Context)

These papers are nearby in arXiv category and useful for broader context, but not necessarily protocol-matched to this paper.

Confusion-Aware Rubric Optimization for LLM-based Automated Grading Category Neighbor

Citations: 0 Relevance: 3.75
- Shared arXiv category (cs.AI)
- Shared metric mentions
- Shared terminology (precision, novel, selection)
When Metrics Disagree: Automatic Similarity vs. LLM-as-a-Judge for Clinical Dialogue Evaluation Category Neighbor

Citations: 0 Relevance: 3.30
- Shared arXiv category (cs.AI)
- Shared metric mentions
- Shared terminology (precision, selection)
Contextualized Privacy Defense for LLM Agents Category Neighbor

Citations: 0 Relevance: 3.20
- Shared arXiv category (cs.CR, cs.AI)
Jailbreak Foundry: From Papers to Runnable Attacks for Reproducible Benchmarking Category Neighbor

Citations: 0 Relevance: 3.20
- Shared arXiv category (cs.CR, cs.AI)
According to Me: Long-Term Personalized Referential Memory QA Category Neighbor

Citations: 0 Relevance: 2.85
- Shared arXiv category (cs.AI)
- Shared metric mentions
- Shared terminology (recall)
Optimizing In-Context Demonstrations for LLM-based Automated Grading Category Neighbor

Citations: 0 Relevance: 2.50
- Shared arXiv category (cs.AI)
- Shared terminology (novel, selection)
Faster, Cheaper, More Accurate: Specialised Knowledge Tracing Models Outperform LLMs Category Neighbor

Citations: 0 Relevance: 2.40
- Shared arXiv category (cs.AI)
- Shared metric mentions
LexChronos: An Agentic Framework for Structured Event Timeline Extraction in Indian Jurisprudence Category Neighbor

Citations: 0 Relevance: 2.40
- Shared arXiv category (cs.AI)
- Shared metric mentions

Need human evaluators for your AI research? Scale annotation with expert AI Trainers.

Post a Job Get a Quote