Scholarlink

<p>With the increasing complexity of cyber attacks, especially advanced persistent threats (APT) that exhibit multi-stage, stealthy, and long-cycle characteristics, traditional provenance methods struggle to effectively capture the semantic associations and causal relationships in attack behaviors. This study addresses the challenges of semantic reasoning and provenance in complex attack scenarios by leveraging the self-attention mechanism of the Transformer model to construct a semantic reasoning-based attack provenance mechanism. The mechanism achieves attack path reconstruction and origin localization through semantic encoding of system logs and network traffic, followed by multi-head attention fusion, significantly improving provenance accuracy while reducing false positive rates. Experiments conducted on multiple public APT datasets demonstrate that the proposed mechanism achieves a provenance accuracy of 95.6%, representing a 12.3% improvement over traditional graph neural network methods, with a 15.8% increase in F1 score. These results provide effective technical support for APT attack provenance and point to new research directions in cybersecurity threat intelligence analysis.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Research on transformer-based semantic reasoning and attack provenance mechanism for complex attack scenarios

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年5月17日

查看全文
  • Feng Guo,
  • Shuang Qiu,
  • Hao Feng,
  • Chenyan Zhang

摘要

With the increasing complexity of cyber attacks, especially advanced persistent threats (APT) that exhibit multi-stage, stealthy, and long-cycle characteristics, traditional provenance methods struggle to effectively capture the semantic associations and causal relationships in attack behaviors. This study addresses the challenges of semantic reasoning and provenance in complex attack scenarios by leveraging the self-attention mechanism of the Transformer model to construct a semantic reasoning-based attack provenance mechanism. The mechanism achieves attack path reconstruction and origin localization through semantic encoding of system logs and network traffic, followed by multi-head attention fusion, significantly improving provenance accuracy while reducing false positive rates. Experiments conducted on multiple public APT datasets demonstrate that the proposed mechanism achieves a provenance accuracy of 95.6%, representing a 12.3% improvement over traditional graph neural network methods, with a 15.8% increase in F1 score. These results provide effective technical support for APT attack provenance and point to new research directions in cybersecurity threat intelligence analysis.