Collaborative APT detection through cloud-edge synergy of graph transformer and lightweight clustering

With the increasing stealth and severity of cyberattacks, the demand for advanced persistent threat (APT) detection systems that deeply understand complex system behaviors has grown substantially. However, existing provenance-based methods often struggle to balance prediction accuracy with inference latency across distributed, resource-constrained environments. To address this, we propose CE-GTC , a collaborative intelligence framework that synergizes large and small models across the cloud-edge continuum. Specifically, the system constructs provenance graphs to capture causal system interactions. In the cloud, a heavy Graph Transformer (the large model) performs computationally intensive representation learning—utilizing edge-feature injection and self-supervised objectives—to extract discriminative embeddings and compact normal behavior profiles. Meanwhile, edge devices host a lightweight clustering detector (the small model) for real-time, privacy-aware anomaly detection via Inverse Document Frequency (IDF)-weighted hybrid distance computation against multi-cluster centers. Experimental evaluations on the Unicorn Wget and StreamSpot datasets demonstrate that CE-GTC achieves superior performance, including an F1-score up to 0.974 and response latency under one second. This highlights the effectiveness of large-small model synergy for scalable, secure, and intelligent APT detection.