<p>Due to the continuous evolution of APT attack techniques, intrusion detection systems based on fixed rules often fail to effectively identify new threats. To efficiently process the massive and continuously generated system audit logs, the method first constructs a provenance graph within a designated edge threshold period, reducing runtime memory consumption while providing a structured data foundation for parallelizable attack detection. An improved GraphSAGE model is then introduced to capture contextual relationships among system entities, extracting both topological and intrinsic node features in a manner suitable for distributed training. To enhance classification robustness under streaming conditions, a multi-period updated One-Class Support Vector Machine (OCSVM) is developed, enabling incremental anomaly detection with low latency. Comprehensive experiments on two public datasets, DARPA TC and StreamSpot, demonstrate that the proposed method achieves significant improvements in both detection accuracy and computational efficiency. More importantly, the design is inherently scalable to high-performance computing (HPC) platforms and real-time processing environments, making it well aligned with the demands of large-scale APT detection in supercomputing scenarios.</p>