BWG: An IOC Identification Method for Imbalanced Threat Intelligence Datasets

APT attacks are becoming increasingly complex and stealthy. To effectively counter APT attacks, modelling threat intelligence data based on graphs, identifying Indicators of Compromise (IOC) nodes, and providing early warnings have become new research hotspots. However, the problem of node category imbalance in such graph datasets restricts the identification capabilities of these methods. Therefore, this paper proposes a supervised graph data augmentation method. In the training phase, graph disentangled representation learning is utilized to perform feature embedding for minority class nodes, effectively alleviating the sparsity problem faced by traditional methods and effectively integrating neighbourhood information of minority class nodes at a higher semantic level. Additionally, two loss functions designed based on link prediction and prototype constraints enhance node type consistency and semantic consistency, respectively. Experimental results on the APT and PDNS datasets demonstrate that the proposed method outperforms other baseline models in identification performance; even in highly imbalanced scenarios, it surpasses the second-best model.