Detecting advanced persistent threats via casual graph neural network

APT attacks are highly dangerous and covert, making them difficult to detect using conventional security measures. Causal analysis based on trace graphs has become a common method for APT detection. However, previous work has encountered several issues, such as the inability to fully utilize contextual information from trace graphs, the requirement for prior records of APT attacks, and excessive computational overhead. This paper proposes an effective self-supervised learning-based method for APT detection. By leveraging provenance graphs and graph representation learning techniques, this method enables multi-granularity detection and effectively accomplishes the task of system anomaly detection. The model adopts outlier detection techniques, enabling APT detection at both the entity level and batch log level. We evaluated our method on three public datasets, and the results demonstrate that our approach achieves optimal detection performance while significantly outperforming existing APT detection methods in terms of computational overhead.