Sanfeng Zhang

Two-Stage APT Detection with Event-Level Evidence Recovery over Heterogeneous Provenance Graphs

: Advanced Persistent Threats (APTs) are low-frequency, stealthy, and multi-stage attacks whose activities are embedded in massive volumes of benign host audit events, making both accurate detection and post-alert investigation challenging. Provenance graphs provide unified representations of interactions among process...