Data for: Dynamic Defense Strategy Against Advanced Persistent Threat Under Heterogeneous Networks

data.mat represents the operations of different kinds of nodes acquired from the real information system. count.mat represents that fusing data observed from monitoring nodes, sink nodes and the Internet together. count1.mat, count2.mat, and count3.mat denote the performance of only using nodes in the monitor area, sink area, and the Internet respectively. count12.mat means fusing monitoring nodes and sink nodes. count13.mat means fusing monitoring nodes and the Internet nodes. count23.mat means fusing sink nodes and the Internet nodes. ROCF.mat, ROCN.mat, ROCI.mat, and ROCS.mat denote the ROC curves of NetF and other single features respectively.