HGAFA: Heterogeneous Graph Attention-Based Featureless Aggregation for IoC Joint Identification

Malicious cyber activities can potentially be detected through indicators of compromise (IoCs). As attacks become more complex, IoCs can be increasingly interconnected; thus, motivating the use of graph-based modeling. However, current approaches face three key challenges: limited and small-scale benchmarks that hinder industrial applicability, reliance on expert-designed meta-paths that restricts generalization in heterogeneous graphs, and insufficient interpretability, which increases the cost of verifying false positives. To address these challenges, we propose a web-scale IoC heterogeneous graph (IoCHG) that models domains, files, IPs, and URLs with seven interaction types, constructed through malware sandbox execution and open-source threat intelligence. Building on IoCHG, we develop Heterogeneous Graph Attention-based Featureless Aggregation (HGAFA) to support joint IoC identification. HGAFA leverages node and edge attention to capture IoC subgraph structures without meta-paths or hand-crafted features, thereby reducing reliance on expert knowledge. Our approach further improves interpretability through edge masking. To our knowledge, this is the first approach to model large-scale IoCs and identify malicious IoCs without expert-designed features. Experiments on millions of nodes from an industrial dataset show that HGAFA outperforms five competing approaches by an average of 8% in precision, while its interpretable subgraphs assist security experts in analyzing attack scenarios.