Advanced Persistent Threat (APT) is widely acknowledged as a formidable cyberspace danger that may result in critical data leakage and huge losses. Some processes of APT attacks inevitably expose behavioral beacons in traffic, which makes it possible to detect APT attacks from traffic. Unlike deploying attack detectors at end devices or critical servers, anomaly detection at the network entrance provides a larger monitoring field but has to bear a huge traffic load. In addition, traditional approaches focus on specific protocols or scenarios, making dealing with complex and volatile APT attacks difficult. Thus, it is challenging to catch up with the ever-growing high-speed traffic and accurately identify complex attacks from it. In this paper, we present SNIPER, a highly efficient and accurate network-side APT detection system. SNIPER uses a multi-task model to capture more comprehensive characterization information about the traffic. This rich characterization information provides the basis for accurately identifying attack traffic. Then, to avoid the additional overhead of running a large multi-tasking model and to further improve detection speed, SNIPER distills the shared feature layer of the multi-tasking model into a lightweight model for final anomaly detection. With this design, SNIPER can identify much of the activity during an APT attack with extreme accuracy at a rate that matches enterprise traffic. Finally, we evaluate SNIPER on the DAPT dataset, and the result shows that SNIPER surpasses the baseline approach in all metrics, obtaining an F1 score of 0.99.