A Hierarchical Approach for Advanced Persistent Threat Detection with Attention-Based Graph Neural Networks

Considering the stealthiness and persistence of Advanced Persistent Threats (APTs), system audit logs are leveraged in recent studies to construct system entity interaction provenance graphs to unveil threats in a host. Rule-based provenance graph APT detection approaches require elaborate rules and cannot detect unknown attacks, and existing learning-based approaches are limited by the lack of available APT attack samples or generally only perform graph-level anomaly detection, which requires lots of manual efforts to locate attack entities. This paper proposes an APT-exploited process detection approach called ThreatSniffer, which constructs the benign provenance graph from attack-free audit logs, fits normal system entity interactions and then detects APT-exploited processes by predicting the rationality of entity interactions. Firstly, ThreatSniffer understands system entities in terms of their file paths, interaction sequences, and the number distribution of interaction types and uses the multi-head self-attention mechanism to fuse these semantics. Then, based on the insight that APT-exploited processes interact with system entities they should not invoke, ThreatSniffer performs negative sampling on the benign provenance graph to generate non-existent edges, thus characterizing irrational entity interactions without requiring APT attack samples. At last, it employs a heterogeneous graph neural network as the interaction prediction model to aggregate the contextual information of entity interactions, and locate processes exploited by attackers, thereby achieving fine-grained APT detection. Evaluation results demonstrate that anomaly-based detection enables ThreatSniffer to identify all attack activities. Compared to the node-level APT detection method APT-KGL, ThreatSniffer achieves a 6.1% precision improvement because of its comprehensive understanding of entity semantics.

With the wide use of Cyber-Physical Systems (CPS) in many applications, targets of advanced persistent threats (APTs) have been extended to the IoT and industrial control systems. Provenance graph analysis based on system audit logs has become a promising way for APT detection and investigation. However, we cannot afford to ignore that existing provenance-based APT detection systems lack the process–context information at system runtime, which seriously limits detection performance. In this paper, we proposed ConGraph, an approach for detecting APT attacks using provenance graphs combined with process context; we presented a module for collecting process context to detect APT attacks. This module collects file access behavior, network access behavior, and interactive relationship features of processes to enrich semantic information of the provenance graph. It was the first time that the provenance graph was combined with multiple process–context information to improve the detection performance of APT attacks. ConGraph extracts process activity features from the provenance graphs and submits the features to a CNN-BiLSTM model to detect underlying APT activities. Compared to some state-of-the-art models, our model raised the average precision rate, recall rate, and F-1 score by 13.12%, 25.61%, and 24.28%, respectively.

Designing systems that can infiltrate networks, remain undetected for long periods, and extract sensitive information make Advanced Persistent Threats (APTs) some of the most sophisticated and powerful cyber-attacks. Most APTs circumvent conventional Intrusion Detection Systems (IDS) because of signature-based detection technology that relies on static patterns and is blind to new forms of threats. To bridge this gap, we put forth a comprehensive framework that applies machine learning through the incorporation of Random Forest, Isolation Forest, and Long Short-Term Memory (LSTM) networks aimed at APT detection. Random Forest, as a supervised learning algorithm, will extract known attack patterns while Isolation Forest, as an unsupervised algorithm, will capture anomalous network behavior corresponding to unknown attacks. With LSTM networks, complex multivariate network traffic patterns are analyzed to identify complex attack behaviors. The UNSW-NB15 dataset, which contains various attack scenarios as well as normal network traffic, is used for training and testing the models. The combination of these technologies is deployed on a scalable serverless infrastructure through A WS SageMaker and real-time data streams are processed using A WS Kinesis. The experimental findings show substantial improvements in accuracy, precision, and recall in both batch and real-time detection scenarios. This approach provides a comprehensive and flexible solution to counter evolving cyber threats with enhanced network security.

Advanced Persistent Threat (APT) attacks have caused serious security threats and financial losses worldwide. Various real-time detection mechanisms that combine context information and provenance graphs have been proposed to defend against APT attacks. However, existing real-time APT detection mechanisms suffer from accuracy and efficiency issues due to inaccurate detection models and the growing size of provenance graphs. To address the accuracy issue, we propose a novel and accurate APT detection model that removes unnecessary phases and focuses on the remaining ones with improved definitions. To address the efficiency issue, we propose a state-based framework in which events are consumed as streams and each entity is represented in an FSA-like structure without storing historic data. Additionally, we reconstruct attack scenarios by storing just one in a thousand events in a database. Finally, we implement our design, called <small>Conan</small>, on Windows and conduct comprehensive experiments under real-world scenarios to show that <small>Conan</small> can accurately and efficiently detect all attacks within our evaluation. The memory usage and CPU efficiency of <small>Conan</small> remain constant over time (1-10 MB of memory and hundreds of times faster than data generation), making <small>Conan</small> a practical design for detecting both known and unknown APT attacks in real-world scenarios.

Cyber security has become a matter of a global interest, and several attacks target industrial companies and governmental organizations. The advanced persistent threats (APTs) have emerged as a new and complex version of multi-stage attacks (MSAs), targeting selected companies and organizations. Current APT detection systems focus on raising the detection alerts rather than predicting APTs. Forecasting the APT stages not only reveals the APT life cycle in its early stages but also helps to understand the attacker’s strategies and aims. This paper proposes a novel intrusion detection system for APT detection and prediction. This system undergoes two main phases; the first one achieves the attack scenario reconstruction. This phase has a correlation framework to link the elementary alerts that belong to the same APT campaign. The correlation is based on matching the attributes of the elementary alerts that are generated over a configurable time window. The second phase of the proposed system is the attack decoding. This phase utilizes the hidden Markov model (HMM) to determine the most likely sequence of APT stages for a given sequence of correlated alerts. Moreover, a prediction algorithm is developed to predict the next step of the APT campaign after computing the probability of each APT stage to be the next step of the attacker. The proposed approach estimates the sequence of APT stages with a prediction accuracy of at least 91.80%. In addition, it predicts the next step of the APT campaign with an accuracy of 66.50%, 92.70%, and 100% based on two, three, and four correlated alerts, respectively.

Advanced persistent threats (APTs) are cyberattacking that use covert strategies to target specific groups. As a result of the rapid growth of computing technology and the widespread connectivity of devices, there has been a boom in data transfer across networks. Because APTs' attack tactics are always changing, it can be difficult to detect them. This has led cybersecurity experts to develop creative solutions. We found gaps in the research on APT detection by doing a systematic literature review (SLR) covering the years 2012 to 2022 and finding 75 studies related to computer, mobile, and Internet of Things technologies. The most sophisticated cyberattack, known as an advanced persistent threat, involves malevolent individuals breaking into a network without authorization and staying hidden for an extended period. Advancement persistent threat attacks and organizational threats are becoming more frequent. Machine learning is one technique used to detect attacks by sophisticated persistent threats. The need for improved detection methods is highlighted by our findings, and we offer suggestions to guide the creation of early APT detection models and progress in cybersecurity. We propose a conceptual model known as Cyber Guardian that uses Random Forest classifier and attention techniques to create a self-translation machine through an encoder-decoder framework. These advanced attention algorithms are intended to improve the machine's capacity to examine and decipher intricate patterns found in HTTP requests, enhancing APT detection capabilities, and providing cybersecurity experts with cutting-edge instruments to proactively detect and neutralize new threats in real-time. This all-encompassing strategy is a major advancement in the ongoing fight against Advanced Persistent Threats (APTs) and emphasizes how crucial it is for the cybersecurity community to continuously innovate and collaborate in order to remain ahead of changing cyberthreats.

Nowadays, countries face a multitude of electronic threats that have permeated almost all business sectors, be it private corporations or public institutions. Among these threats, advanced persistent threats (APTs) stand out as a well-known example. APTs are highly sophisticated and stealthy computer network attacks meticulously designed to gain unauthorized access and persist undetected threats within targeted networks for extended periods. They represent a formidable cybersecurity challenge for governments, corporations, and individuals alike. Recognizing the gravity of APTs as one of the most critical cybersecurity threats, this study aims to reach a deeper understanding of their nature and propose a multi-stage framework for automated APT detection leveraging time series data. Unlike previous models, the proposed approach has the capability to detect real-time attacks based on stored attack scenarios. This study conducts an extensive review of existing research, identifying its strengths, weaknesses, and opportunities for improvement. Furthermore, standardized techniques have been enhanced to enhance their effectiveness in detecting APT attacks. The learning process relies on datasets sourced from various channels, including journal logs, traceability audits, and systems monitoring statistics. Subsequently, an efficient APT detection and prevention system, known as the composition-based decision tree (CDT), has been developed to operate in complex environments. The obtained results demonstrate that the proposed approach consistently outperforms existing algorithms in terms of detection accuracy and effectiveess.

In the rapidly evolving cybersecurity landscape, Advanced Persistent Threats (APTs) pose major challenges due to their stealthy and adaptive behavior. Traditional detection methods based on signatures or heuristics are limited in identifying novel and evolving attacks, while static deep learning models suffer from concept drift and catastrophic forgetting, leading to degraded performance over time. This paper proposes an adaptive APT detection framework that integrates Graph Neural Networks (GNNs) with rehearsal-based continual learning using telemetry data from Wazuh, an open-source Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platform. Endpoint telemetry is represented as graphs where nodes denote system components and edges describe behavioral interactions among them. Experimental evaluations on real-world Wazuh telemetry augmented with sandbox-executed APT scenarios demonstrate that the proposed approach consistently achieves F1-scores above 0.98, outperforming static and fine-tuned baselines in both adaptability and knowledge retention. These results confirm that combining graph-based representations with continual learning offers a scalable, interpretable, and resilient solution for modern SOC and EDR environments facing advanced and evolving cyber threats.

Advanced persistent threats (APTs) consist of multiple attack stages between entry and exit points of the attack. In each stage of the attack, the adversary gathers more privileges, resources, and information about the system and uses this information to gain access to the targeted data of the next stage to reach the final goal. APTs are not only persistent but also stealthy and hence difficult to detect. The persistent nature of APTs, however, creates information flows in the system that can be monitored. One monitoring mechanism is Dynamic Information Flow Tracking (DIFT), which taints and tracks malicious information flows through a system and inspects the flows at designated traps. Since tainting all flows in the system will incur prohibitive resource costs, efficient tagging policies are needed to decide which flows to tag in order to maximize the probability of APT detection while minimizing resource overhead. At present such an analytical model for DIFT for multi-stage APT detection does not exist. In this paper, we propose a game theoretic framework modeling real-time detection of multi-stage APTs via DIFT. We formulate a two-player (APT vs DIFT) nonzero-sum stochastic game with incomplete information to obtain an optimal tagging policy. Our game model consists of a sequence of stages, where each stage of the game corresponds to a stage in the attack. At each stage, the goal of the APT is to reach a particular destination, corresponding to a targeted resource or privilege, while the goal of the defender is to detect the APT. We first derive an efficient algorithm to find locally optimal strategies for both players. We then characterize the best responses of both players and present algorithms to find the best responses. Finally, we validate our results on a real-world attack data set obtained using the Refinable Attack INvestigation (RAIN) framework for a ScreenGrab attack.

Advanced Persistent Threats (APTs) employ sophisticated and covert tactics to infiltrate target systems, leading to increased vulnerability and an elevated risk of exposure. Consequently, it is essential for us to proactively create an extensive and clearly outlined attack chain for APTs in order to effectively combat these threats. Unlike traditional malware or application threats, APTs can sidestep cyber security efforts and cause severe damage to organizations or even state security. Nonetheless, earlier methods struggle to accurately track APTs and may face a dependency explosion issue, as identifying the intricate and complex unknown malicious activities within APTs proves to be challenging. In this paper, we propose and build an approach, T-trace, which constructs the events provenance graphs by analyzing the correlations among logs. The approach precisely finds the log communities with tensor decomposition and calculates significance scores to extract the events. The APTs can be inferred by discovering the event communities and constructing the provenance graph with log correlation. In the experiment, we used DARPA data sets and launched four current practical APTs. Compared with current approaches, the results show that T-trace can efficiently reduce time cost by 90% and achieve a 92% accuracy rate in constructing the provenance graph, which can be practically applied in APTs provenance.

Detection of advanced persistent threat using machine-learning correlation analysis

Advanced Persistent Threat (APT) attacks represent a sophisticated and growing danger to modern information systems. While provenance graphs are a promising tool for detecting these complex threats, their effectiveness is often limited by a failure to harness the rich semantic information contained within raw system logs. This paper proposes a novel detection framework that addresses this gap by leveraging a Large Language Model (LLM) to embed deep semantic meaning from system logs directly into the graph's features. Our approach enhances a state-of-the-art Graph Neural Network (GNN)-based method by replacing its simple embedding technique with an LLM-based sentence embedding method, specifically enriching the graph's edge features to capture deeper contextual information. Experimental results on the challenging Unicorn Wget dataset demonstrate the superiority of our method. It surpassed the baseline in all evaluation metrics, achieving an F1-Score of 96.12 % and an AUC of 98.52 %, compared to the baseline's 94.36 % F1-Score and 97.39% AUC. Furthermore, our method achieved a lower false positive rate of 6.68 %, indicating a more precise and reliable detection capability. These findings highlight the value of integrating semantic embeddings from LLMs to improve the detection of stealthy, complex cyberattacks.

The progression and treatment response of cancer largely depends on the complex tissue structure that surrounds cancer cells in a tumour, known as the tumour microenvironment (TME). Recent technical advances have led to the development of highly multiplexed imaging techniques such as Imaging Mass Cytometry (IMC), which capture the complexity of the TME by producing spatial tissue maps of dozens of proteins. Combining these multidimensional cell phenotypes with their spatial organization to predict clinically relevant information is a challenging computational task and so far no method has addressed it directly. Here, we propose and evaluate MULTIPLAI, a novel framework to predict clinical biomarkers from IMC data. The method relies on attention-based graph neural networks (GNNs) that integrate both the phenotypic and spatial dimensions of IMC images. In this proof-of-concept study we used MULTIPLAI to predict oestrogen receptor (ER) status, a key clinical variable for breast cancer patients. We trained different architectures of our framework on 240 samples and benchmarked against graph learning via graph kernels. Propagation Attribute graph kernels achieved a class-balanced accuracy of 66.18% in the development set (N = 104) while GNNs achieved a class-balanced accuracy of 90.00% on the same set when using the best combination of graph convolution and pooling layers. We further validated this architecture in internal (N = 112) and external test sets from different institutions (N = 281 and N = 350), demonstrating the generalizability of the method. Our results suggest that MULTIPLAI captures important TME features with clinical importance. This is the first application of GNNs to this type of data and opens up new opportunities for predictive modelling of highly multiplexed images.

Provenance-based Intrusion Detection Systems (IDS) model the causal relationships between security events through a provenance graph and learn contextual information to detect Advanced Persistent Threats (APTs) effectively. However, existing provenance graph representation methods fail to fully reflect the characteristics of security domain data and the semantic information embedded in system logs, resulting in limitations in learning efficiency and detection accuracy. This paper proposes a provenance representation method that effectively captures security context from system log data. The proposed method improves the performance of provenance-based IDS by combining (1) a provenance graph construction technique that transforms meaningful string attributes—such as command lines, process names, and file paths—into vector representations to extract semantic information in the security context, (2) a hybrid time-position embedding technique for capturing causal relationships between events, and (3) an iterative refinement learning strategy tailored to the characteristics of system log data. Experimental results using the DARPA Transparent Computing Engagement 3 (E3) benchmark dataset for APT detection demonstrate that our method achieves improved accuracy compared to existing approaches while significantly accelerating convergence during iterative training. These results suggest that the proposed embedding technique can more effectively capture abnormal temporal patterns, such as long dwell times characteristic of APT attacks.

System audit logs are widely adopted in enterprise security by their support for causality analysis that generates provenance graphs to investigate advanced attacks. However, detecting attack activity in the overwhelming amount of logs is like looking for a needle in a haystack, which slows down the speed of attack investigation. In this paper, we propose an automated approach for attack detection and investigation by learning the contextual semantics of the provenance graph. Our framework uncovers the semantics of the attack events through the structural context of audit logs. Further, an attention-based graph convolutional neural network is utilized to capture the structural identity associated with the attack path. It is important to note that when inferring whether a specific system node is malicious or not, our approach optimizes the provenance subgraph generated for that node without destroying its contextual semantics. The discovered attack nodes are correlated chronologically for attack investigation and scenario reconstruction. Our approach is evaluated on a real-world Advanced Persistent Threats (APT) dataset. The results show that our approach has a high F1 score (95.97%) for identifying attack nodes in audit logs and speeds up the process of attack investigation (reducing the analysis workload by 91.24%).