APT Attack Detection Method Based on Long-Term Feature Extraction from Provenance Graphs

As the frequency of Advanced Persistent Threat attacks rises, cybersecurity threats are becoming increasingly severe. Detecting APTs, a critical method for addressing complex attack behaviors, requires more resilient and efficient approaches. This paper presents a novel detection technique that leverages long-term feature extraction from provenance graphs, utilizing multi-head attention mechanisms and embedding strategies. Our approach first captures long-term feature sequences by exploiting the topological structure of provenance graph networks. A multi-head attention mechanism is then applied to integrate historical data with current local context, enhancing the distinction between normal and malicious behaviors in the feature space. Finally, the K-means clustering algorithm is employed for unsupervised detection of APTs. Experimental results across five popular datasets demonstrate that, compared to three leading APT detection methods, our approach significantly improves detection accuracy and efficiency, offering a more robust solution for addressing complex APT attack scenarios.