APTD: APT Detection Through Enhanced Provenance Graph Learning

With the development of advanced persistent threat (APT) technology, cyber criminals’ intrusions have become more precise, threatening the information security of commercial entities and government agencies through data theft and surveillance. Although existing APT detection schemes have certain APT identification capabilities, they fail to fully utilize the relational features in log data to construct graph representations. This study designs an APT detection scheme APTD based on graph neural network (GNN) technology, which uses autoencoders to extract graph vectors from enhanced provenance graphs (EP graphs) and combines the K -nearest neighbor (KNN) classification algorithm for abnormal pattern recognition, thereby effectively detecting APT attacks. In the evaluation based on the DARPA dataset, the APTD model performed well in APT detection, with an accuracy of $\mathbf{9 9 . 5 0 \%}$ and a recall of $\mathbf{9 9 . 0 9 \%}$, showing qualified APT identification capabilities.