RiskCal-APT: A Decision-Centric Framework for Calibrated Advanced Persistent Threat Detection and High-Risk Mitigation

Advanced Persistent Threats (APTs) are difficult to defend against because the attacks are long-lived, span several hosts, and rely on tools that closely resemble legitimate administrator activity. Most intrusion detection systems (IDSs) treat APT defense as an ordinary classification problem, without probability calibration or cost-sensitive reasoning about response actions, which leads to costly misclassifications, false alarms, and unreliable alerts. This paper presents RiskCal-APT, a framework that formulates APT detection as a risk-aware decision support problem. The framework builds three complementary views of enterprise telemetry, namely network flows, temporal event sequences, and provenance graphs, each processed by a dedicated model. The view outputs are fused under the guidance of an attack-stage estimator, and inter-view disagreement is used explicitly to handle partial observability. The fused scores are calibrated with Temperature Scaling and combined with asset criticality, behavioral persistence, and lifecycle-stage severity into an Operational Risk Score (ORS) that drives automated or semi-automated response actions. On the DARPA Operationally Transparent Cyber (OpTC) dataset, RiskCal-APT achieves an F1-score of 0.932, a Matthews correlation coefficient (MCC) of 0.928, an operational false alert rate of 0.0028%, an Early Detection Lead Time (EDLT) of 41.8 min, an Alert Reduction Ratio (ARR) of 88.5%, and a Mitigation Utility Score (MUS) of 0.938; on CICIDS2017, it achieves an F1-score of 0.973. These results indicate that combining probability calibration with explicit risk modeling enables earlier detection, better containment, and a lower analyst workload.