APT-LMSPS: An Efficient APT Detection System via Long-Range Meta-Path Progressive Sampling Search

Advanced Persistent Threats (APTs) are characterized by stealth, infrequency, and long cycles, evading traditional security to endanger critical infrastructure. Complex semantic links between system entities can be accurately modeled using representation learning techniques based on heterogeneous provenance graphs, providing a novel method for uncovering hidden APT attack chains. However, in large-scale practical implementations, this approach still faces three major challenges: combinatorial explosion of long-range meta-paths, loss of semantic evolution during graph compression, and high computational overhead for dynamic environments. To address these, we propose APT-LMSPS, a detection system leveraging Long-Range Meta-path Progressive Sampling Search (LMSPS). The LMSPS algorithm uses dynamic pruning and semantic contribution assessment to convert meta-path combination explosion into constant-scale computation, accurately modeling long-range dependencies. Second, the Maintaining Global Semantics (MGS) approach intelligently filters events by tracking node semantic state changes, achieving an 8:1 compression ratio while preserving over 90% of critical pathways’ semantic integrity. Lastly, the meta-path encoding database uses a caching approach to avoid repeated encoding, doubling encoding effectiveness and enabling efficient, accurate, system-wide APT detection in large-scale scenarios. Evaluated on DARPA, StreamSpot, and ATLAS datasets, APT-LMSPS maintains competitive accuracy (F1-score ≥ 0.98) and improves long-range processing efficiency by an order of magnitude over baselines.