基于溯源图的双阶段一致性与自适应掩码APT检测方法

Provenance graph-based APT detection via dual-phase consistency and adaptive masking

摘要

针对高级持续性威胁(APT)攻击检测准确性与鲁棒性不足的问题,本研究提出一种基于溯源图的双阶段一致性与自适应掩码APT检测方法(DCAM)。DCAM以系统审计日志构建的溯源图为研究对象,采用图掩码自编码器与图注意力网络相结合的深度学习架构。首先综合节点的度中心性、PageRank值、边类型多样性及时间活跃度等多维指标量化节点重要性,通过差异化的掩码率分配引导模型聚焦于关键系统结构的表示学习;其次,设计重建分支恢复被掩码节点的特征,同时设计预测分支推断边类型,并通过一致性约束对齐两分支的隐层表示,从属性特征与结构语义两个维度捕获系统行为模式;最后,利用K近邻算法计算测试样本与正常行为模式的偏离程度实现异常检测。在StreamSpot、Wget及DARPA TC E3公开数据集上的实验结果表明,该方法在各项关键指标上总体优于现有基线方法,验证了其有效性。该研究对于增强APT攻击防御能力、保障关键信息基础设施安全具有一定的理论价值与实践意义。

Abstract

To address the insufficient accuracy and robustness in advanced persistent threat (APT) attack detection,a provenance graph-based APT detection method with Dual-phase Consistency and Adaptive Masking (DCAM) is proposed.DCAM takes provenance graphs constructed from system audit logs as its research object and employs a deep learning architecture integrating Graph Masked Autoencoder (GMAE) with Graph Attention Network (GAT).The method comprises the following steps:First,node importance is quantified by integrating multiple metrics including degree centrality,PageRank scores,edge type diversity,and temporal activity,with differentiated masking ratios assigned to guide the model toward learning representations of critical system structures.Second,a reconstruction branch is designed to restore masked node features,while a prediction branch is designed to infer edge types,with consistency constraints aligning the hidden representations of both branches to capture system behavior patterns from both attribute features and structural semantics.Finally,anomaly detection is achieved by computing the deviation between test samples and normal behavior patterns using the K-nearest neighbor algorithm.Experimental results on the public StreamSpot,Wget,and DARPA TC E3 datasets demonstrate that the proposed method overall outperforms existing baseline approaches across key evaluation metrics,validating its effectiveness.The findings provide both theoretical value and practical significance for strengthening APT attack defense capabilities and safeguarding critical information infrastructure security.

关键词

高级持续性威胁 / 溯源图 / 双阶段一致性学习 / 多维度自适应掩码 / 入侵检测

Key words

advanced persistent threat (APT) / provenance graph / dual-phase consistency learning / multi-dimensional adaptive masking / intrusion detection

[1] 李元诚,罗昊,王欣煜,等.基于溯源图和注意力机制的APT攻击检测模型构建[J].通信学报,2024,45(3):117-130.
[2] 金志刚,李紫梦,陈旭阳,等.面向数据不平衡的网络入侵检测系统研究综述[J].信息网络安全,2025,25(8):1240-1253.
[3] 仇晶,陈荣融,朱浩瑾,等.基于溯源图的网络攻击调查研究综述[J].电子学报,2024,52(7):2529-2556.
[4] 姚毅,欧阳瑞琦,欧卫华,等.基于图谱域特征的对抗攻击算法[J].贵州师范大学学报(自然科学版),2025,43(5):84-91.
[5] 彭长根,何兴,谭伟杰,等.人工智能算法安全研究现状与对策[J].贵州师范大学学报(自然科学版),2022,40(6):1-16.
[6] Jia Zian,Xiong Yun,Nan Yuhong,et al.MAGIC:detecting advanced persistent threats via masked graph representation learning[C]//Proceedings of the 33rd USENIX Security Symposium (USENIX Security 2024).Berkeley,CA:USENIX Association,2024:4865-4882.
[7] Tan Zhuoran,Parambath S P,Anagnostopoulos C,et al.Advanced persistent threats based on supply chain vulnerabilities:challenges,solutions & future directions[J].IEEE Internet of Things Journal,2025,12(6):6371-6395.
[8] 杨秀璋,彭国军,刘思德,等.面向APT攻击的溯源和推理研究综述[J].软件学报,2025,36(1):203-252.
[9] Milajerdi S M,Gjpmemo R,Eshete B,et al.HOLMES:real-time APT detection through correlation of suspicious information flows[C]//Proceedings of the 2019 IEEE Symposium on Security and Privacy (S&P 2019).Los Alamitos,CA:IEEE,2019:1137-1152.
[10] 王加梁.基于属性分类建模的入侵检测方法[J].计算机工程与设计,2022,43(4):907-913.
[11] 张宇翔,韩久江,刘建,等.ATT&CK框架下基于事件序列关联的网络高级威胁检测系统[J].计算机科学,2023,50(S1):710-716.
[12] 张浩,谢大智,胡云晟,等.基于半监督学习的网络异常检测研究综述[J].信息网络安全,2024,24(4):491-508.
[13] 程渝栋,周昉.基于半监督学习的未知异常检测方法[J].计算机研究与发展,2024,61(7):1670-1680.
[14] Karim S S,Afzal M,Iqbal W,et al.SLF-ADM:securing Linux frontiers:advanced persistent threat (APT) detection using machine learning[J].Neural Computing and Applications,2025,37(21):16715-16734.
[15] Zhong Meihui,Lin Mingwei,Zhang Chao,et al.A survey on graph neural networks for intrusion detection systems:methods,trends and challenges[J].Computers & Security,2024,141:103821.
[16] Mutalib N H A,Sabri A Q M,Wahab A W A,et al.Explainable deep learning approach for advanced persistent threats (APTs) detection in cybersecurity:a review[J].Artificial Intelligence Review,2024,57(11):297.
[17] 杨晓文,张健,况立群,等.融合CNN-BiGRU和注意力机制的网络入侵检测模型[J].信息安全研究,2024,10(3):202-208.
[18] Basnet A S,Ghanem M C,Dunsin D,et al.Advanced persistent threats (apt) attribution using deep reinforcement learning[J].Digital Threats:Research and Practice,2025,6(3):1-23.
[19] 李小剑,谢晓尧.基于支持向量机与K近邻相结合的网络入侵检测研究[J].贵州师范大学学报(自然科学版),2015,33(3):86-91.
[20] Hossai M N,Milajerdi S M,Wang Junao,et al.SLEUTH:real-time attack scenario reconstruction from COTS audit data[C]//Proceedings of the 26th USENIX Security Symposium (USENIX Security 2017).Berkeley,CA:USENIX Association,2017:487-504.
[21] Manzoor E,Milajerdi S M,Akoglu L.Fast memory-efficient anomaly detection in streaming heterogeneous graphs[C]//Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining.New York:ACM,2016:1035-1044.
[22] Han Xueyuan,Pasquier T,Bates A,et al.UNICORN:runtime provenance-based detector for advanced persistent threats[C]//Proceedings of the 2020 Network and Distributed System Security Symposium (NDSS 2020).Reston,VA:Internet Society,2020.
[23] Wang Su,Wang Zhiliang,Zhou Tao,et al.Threatrace:detecting and tracing host-based threats in node level through provenance graph learning[J].IEEE Transactions on Information Forensics and Security,2022,17:3972-3987.
[24] Alsaheel A,Nan Yuhong,Ma Shiqing,et al.ATLAS:a sequence-based learning approach for attack investigation[C]//Proceedings of the 30th USENIX Security Symposium (USENIX Security 2021).Berkeley,CA:USENIX Association,2021:3005-3022.
[25] Cheng Zijun,Lü Qiujian,Liang Jinyuan,et al.KAIROS:practical intrusion detection and investigation using whole-system provenance[C]//Proceedings of the 45th IEEE Symposium on Security and Privacy (S&P 2024).Los Alamitos,CA:IEEE,2024.
[26] Zhang Bo,Gao Yansong,Yu Changlong,et al.TAPAS:an efficient online APT detection with task-guided process provenance graph segmentation and analysis[C]//34th USENIX Security Symposium (USENIX Security 25).2025:607-624.

基金资助

国家自然科学基金项目(62441212);内蒙古自然科学基金重点项目(2025ZD008);内蒙古自治区档案科技项目(2025-35)