Efficient Host Threat Detection Using The Procsage Method

Advanced Persistent Threats (APTs) pose a significant challenge to modern cybersecurity due to their stealth and complexity. This paper introduces a scalable host threat detection framework that utilizes provenance graphs and graph representation learning to overcome limitations of traditional defense mechanisms. By optimizing process- and thread-centric analyses within provenance graphs, the system minimizes computational overhead while maintaining robust behavioral insights. Leveraging semantic and topological feature extraction with GraphSAGE-based learning, the framework achieves precise anomaly detection via clustering techniques. Validation on benchmark datasets demonstrates substantial improvements in accuracy, efficiency, and scalability, showcasing the framework's potential for real-world applications.