APT Detection via Hypergraph Attention Network with Community-Based Behavioral Mining
Source abstract
Abstract
Advanced Persistent Threats (APTs) challenge cybersecurity due to their stealthy, multi-stage nature. For the provenance graph based on fine-grained kernel logs, existing methods have difficulty distinguishing behavior boundaries and handling complex multi-entity dependencies, which exhibit high false positives in dynamic environments. To address this, we propose a Hypergraph Attention Network framework for APT detection. First, we employ anomaly node detection on provenance graphs constructed from kernel logs to select seed nodes, which serve as starting points for discovering overlapping behavioral communities via node aggregation. These communities are then encoded as hyperedges to construct a hypergraph that captures high-order interactions. By integrating hypergraph structural semantics with nodes and hyperedge dual attention mechanisms, our framework achieves robust APT detection by modeling complex behavioral dependencies. Experiments on DARPA and Unicorn show superior performance: 97.73% accuracy, 98.35% F1-score, and a 0.12% FPR. By bridging hypergraph theory and adaptive attention, the framework effectively models complex attack semantics, offering a robust solution for real-time APT detection.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Software Engineering Research · Online Learning and Analytics · Advanced Text Analysis Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Computer Science and Technology, Zhejiang University of Technology, Hangzhou 310014, China
Funding
“Pioneer” and “Leading Goose” R&D Program of Zhejiang · National Natural Science Foundation of China
References (26)
Show source-provided references
1. Rehman, M.U., Ahmadi, H., and Hassan, W.U. (2024, January 19–23). Flash: A comprehensive approach to intrusion detection via provenance graph representation learning. Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.
2. Han, X., Pasquier, T., Bates, A., Mickens, J., and Seltzer, M. (2020). Unicorn: Runtime provenance-based detector for advanced persistent threats. arXiv.10.14722/ndss.2020.24046 ↗
3. Jia, Z., Xiong, Y., Nan, Y., Zhang, Y., Zhao, J., and Wen, M. (2024, January 14–16). MAGIC: Detecting advanced persistent threats via masked graph representation learning. Proceedings of the 33rd USENIX Security Symposium (USENIX Security 24), Philadelphia, PA, USA.
4. Cyber security threat modeling based on the MITRE Enterprise ATT&CK Matrix10.1007/s10270-021-00898-7 ↗
5. Lv, M., Gao, H., Qiu, X., Chen, T., Zhu, T., Chen, J., and Ji, S. (2024, January 26–30). TREC: APT tactic/technique recognition via few-shot provenance subgraph learning. Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, Copenhagen, Denmark.10.1145/3658644.3690221 ↗
6. Hyper attack graph: Constructing a hypergraph for cyber threat intelligence analysis10.1016/j.cose.2024.104194 ↗
7. A Fast Method of Detecting Overlapping Community in Network Based on LFM10.17706//jsw.10.7.825-834 ↗
8. Pei, K., Gu, Z., Saltaformaggio, B., Ma, S., Wang, F., Zhang, Z., Si, L., Zhang, X., and Xu, D. (2016, January 5–9). Hercule: Attack story reconstruction via community discovery on correlated log graph. Proceedings of the 32nd Annual Conference on Computer Security Applications, Los Angeles, CA, USA.10.1145/2991079.2991122 ↗
9. T-Trace: Constructing the APTs Provenance Graphs Through Multiple Syslogs Correlation10.1109/TDSC.2023.3273918 ↗
10. Cheng, Z., Lv, Q., Liang, J., Wang, Y., Sun, D., Pasquier, T., and Han, X. (2024, January 19–23). Kairos: Practical intrusion detection and investigation using whole-system provenance. Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP54263.2024.00005 ↗
11. Xu, Z., Fang, P., Liu, C., Xiao, X., Wen, Y., and Meng, D. (2022, January 22–26). Depcomm: Graph summarization on system audit logs for attack investigation. Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP46214.2022.9833632 ↗
12. Hossain, M.N., Milajerdi, S.M., Wang, J., Eshete, B., Gjomemo, R., Sekar, R., Stoller, S., and Venkatakrishnan, V. (2017, January 16–18). SLEUTH: Real-time attack scenario reconstruction from COTS audit data. Proceedings of the 26th USENIX Security Symposium (USENIX Security 17), Vancouver, BC, Canada.
13. Milajerdi, S.M., Gjomemo, R., Eshete, B., Sekar, R., and Venkatakrishnan, V. (2019, January 19–23). Holmes: Real-time apt detection through correlation of suspicious information flows. Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP.2019.00026 ↗
14. Bhatt, P., Yano, E.T., and Gustavsson, P. (2014, January 7–11). Towards a framework to detect multi-stage advanced persistent threats attacks. Proceedings of the 2014 IEEE 8th International Symposium on Service Oriented System Engineering, Oxford, UK.10.1109/SOSE.2014.53 ↗
15. Threat detection and investigation with system-level provenance graphs: A survey10.1016/j.cose.2021.102282 ↗
16. Hypergraph theory
17. Hassan, W.U., Guo, S., Li, D., Chen, Z., Jee, K., Li, Z., and Bates, A. (2019, January 24–27). Nodoze: Combatting threat alert fatigue with automated provenance triage. Proceedings of the Network and Distributed Systems Security Symposium, San Diego, CA, USA.10.14722/ndss.2019.23349 ↗
18. Li, S., Dong, F., Xiao, X., Wang, H., Shao, F., Chen, J., Guo, Y., Chen, X., and Li, D. (2023). Nodlink: An online system for fine-grained apt attack detection and investigation. arXiv.10.14722/ndss.2024.23204 ↗
19. Kellect: A Kernel-based efficient and lossless event log collector for windows security10.1016/j.cose.2024.104203 ↗
20. Overlapping community detection in networks: The state-of-the-art and comparative study10.1145/2501654.2501657 ↗
21. Djidjev, C. (2024). siForest: Detecting Network Anomalies with Set-Structured Isolation Forest. arXiv.
22. Yan, N., Wen, Y., Chen, L., Wu, Y., Zhang, B., Wang, Z., and Meng, D. (2022, January 9–11). Deepro: Provenance-based APT campaigns detection via GNN. Proceedings of the 2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), Wuhan, China.10.1109/TrustCom56396.2022.00106 ↗
23. Webber, B., Cohn, T., He, Y., and Liu, Y. (2020, January 16–20). Be More with Less: Hypergraph Attention Networks for Inductive Text Classification. Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), Online.
24. Manzoor, E., Milajerdi, S.M., and Akoglu, L. (2016, January 13–17). Fast memory-efficient anomaly detection in streaming heterogeneous graphs. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Francisco, CA, USA.10.1145/2939672.2939783 ↗
25. Threatrace: Detecting and tracing host-based threats in node level through provenance graph learning10.1109/TIFS.2022.3208815 ↗
26. Yang, F., Xu, J., Xiong, C., Li, Z., and Zhang, K. (2023, January 9–11). PROGRAPHER: An anomaly detection system based on provenance graph embedding. Proceedings of the 32nd USENIX Security Symposium (USENIX Security 23), Anaheim, CA, USA.