Abstract: Aiming at the detection problems of advanced persistent threats, we proposed a detection method based on the attributes of network connection. Through four steps of data acquisition, characteristic extraction, anomaly detection and realtime alarm, we selected 12 kinds of attributes of network connection and applied machine learning methods to analyze attribute feature data set, and  established detection model of advanced persistent threat attacks. Experimental results show that the proposed method has good detection performance for advanced persistent threat attacks, high detection rate and low false alarm rate.

Key words: advanced persistent threat, attack characteristics, network security detection, machine learning