Iranian Society of Cryptology The ISC International Journal of Information Security 2008-2045 17 2 2025 07 01 DSRL-APT-2023: A New Synthetic Dataset for Advanced Persistent Threats 107 116 214212 10.22042/isecure.2025.214212 EN Hossein Shadabfar Department of Management, Science and Technology of Amirkabir University , Technology Tehran,Iran Motahareh Dehghan Department of Industrial and Systems Engineering Tarbiat Modares University Tehran, Iran 0000-0002-5316-8005 Babak Sadeghian Department of Computer Engineering Amirkabir University of Technology Tehran, Iran Journal Article 2024 12 26 Detecting Advanced Persistent Threats (APTs) is crucial, and a practical approach involves using an intrusion detection system (IDS) integrated with supervised machine learning algorithms. These algorithms require a balanced dataset with ample attack samples to learn and recognize attack patterns effectively. However, widely used APT datasets, such as DAPT2020 and SCVIC-APT-2021, suffer from imbalance issues that limit the performance of machine learning-based intrusion detection systems (IDS). We introduce DSRL-APT-2023, a new balanced synthetic APT dataset generated using CTGAN to address this challenge. The CTGAN model is trained on the DAPT2020 dataset to create this balanced dataset. We evaluate and compare the performance of six standard supervised machine learning algorithms—Decision Tree, Support Vector Machine, K-Nearest Neighbor, Logistic Regression, Random Forest, and Multi-Layer Perceptron— alongside an intrusion detection system (IDS) called Intelligent Intrusion Detection System, which is based on tree-structured machine learning models. Our evaluation focuses on detecting attacks in DSRL-APT-2023 and compares its performance to DAPT2020 and SCVIC-APT-2021. Additionally, we assess the data quality of synthetic datasets generated by two prominent GANs, CopulaGAN, and CTGAN, with CTGAN demonstrating slightly superior performance in generating high-quality tabular data. Our results demonstrate that machine learning algorithms and the Intelligent IDS can accurately detect attacks in the synthetic dataset, as evidenced by the F1-Score metrics. https://www.isecure-journal.com/article_214212_40f652111c696f5eb8da62fe518390fa.pdf