Correlation Analysis of APT Attack Organizations Based on Knowledge Graphs

Advanced Persistent Threats (APTs) exhibit covert behaviors, long attack cycles, and fragmented intelligence, creating challenges for correlation analysis and attribution. This work proposes a unified knowledge-graph-based framework for multi-level APT correlation. We construct an APT ontology and automatically extract entities and relations from threat reports using NER and relation extraction models. The resulting multi-source intelligence is normalized and integrated into a Neo4j knowledge graph containing 15,682 entities and 42,713 relations. Multi-level correlation analysis is then performed through explicit structural reasoning, semantic embedding models such as TransE and RotatE, and a temporal evolution module based on T-GCN to capture dynamic attack-path patterns. Experiments demonstrate that the proposed framework achieves an F1-score of 0.91 for relation extraction and improves APT correlation prediction accuracy by 17.3% over rule-based baselines. The system supports large-scale attack-chain reasoning and sector-oriented threat analysis, providing enhanced attribution and decision support for cybersecurity defense.