This paper presents a novel method for detecting persistent advanced threat (APT) attacks. To address the challenges of securing the massive amounts of labeled data required by conventional supervised learning methods, we combine anomaly detection using autoencoders with active learning. Active learning, which selectively requests labels from an oracle for uncertain or ambiguous samples, reduces labeling costs and improves detection accuracy. Specifically, we present an anomaly detection framework based on the Attention Adversarial Dual AutoEncoder and demonstrate how an active learning loop improves model performance. Using real-world imbalanced process trace data from the DARPA Transparent Computing program (APT-like attacks account for only 0.004% of the data), we evaluate our approach under two attack scenarios across various operating systems, including Android, Linux, BSD, and Windows, demonstrating a significant improvement in detection rates over existing methods.
