Scholarlink

<p>Advanced Persistent Threats (APTs) is one of the most serious cybersecurity threats today, posing a substantial threat to enterprises and organizations due to their stealthy and targeted nature. Data provenance-based methods are widely used for APT detection but often rely on specific rules and high-quality data due to limitations in capturing complete graph structures, reducing their effectiveness in diverse detection environments. To overcome this issue, we propose APT-HERA, a model employs heterogeneous graph representation learning to learn system behavior patterns that can adapt to environments with limited data. The embedding representations of the provenance graph in APT-HERA are derived from both homophily and heterogeneity perspectives, thereby enabling a more comprehensive extraction of the rich structural information contained within the provenance graph. The performance of APT-HERA was evaluated on four public datasets. Experimental results demonstrate that APT-HERA achieves 98% precision in information-constrained detection scenarios, outperforming state-of-the-art methods including MAGIC, Flash, and ThreaTrace under such conditions.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Detecting advanced persistent threats via heterogeneous graph learning from homophily and heterogeneity views

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年3月5日

查看全文
  • Yuanhuang Liu,
  • Ayong Ye,
  • Wenting Lu,
  • Longjing Yang

摘要

Advanced Persistent Threats (APTs) is one of the most serious cybersecurity threats today, posing a substantial threat to enterprises and organizations due to their stealthy and targeted nature. Data provenance-based methods are widely used for APT detection but often rely on specific rules and high-quality data due to limitations in capturing complete graph structures, reducing their effectiveness in diverse detection environments. To overcome this issue, we propose APT-HERA, a model employs heterogeneous graph representation learning to learn system behavior patterns that can adapt to environments with limited data. The embedding representations of the provenance graph in APT-HERA are derived from both homophily and heterogeneity perspectives, thereby enabling a more comprehensive extraction of the rich structural information contained within the provenance graph. The performance of APT-HERA was evaluated on four public datasets. Experimental results demonstrate that APT-HERA achieves 98% precision in information-constrained detection scenarios, outperforming state-of-the-art methods including MAGIC, Flash, and ThreaTrace under such conditions.