Two-Stage APT Detection with Event-Level Evidence Recovery over Heterogeneous Provenance Graphs

Abstract

: Advanced Persistent Threats (APTs) are low-frequency, stealthy, and multi-stage attacks whose activities are embedded in massive volumes of benign host audit events, making both accurate detection and post-alert investigation challenging. Provenance graphs provide unified representations of interactions among processes, files, and network entities, but existing methods still face behavioral heterogeneity across entity types, structurally unsupported anomaly alerts, and limited traceability from detection outputs to original audit events. To address these issues, we propose a two-stage APT detection and event-level evidence recovery framework over heterogeneous provenance graphs. Stage 1 learns type-aware benign representations through self-supervised graph representation learning and generates a high-recall candidate set by jointly modeling within-type embedding deviation, behavioral feature reconstruction error, and node type prediction uncertainty. Stage 2 refines membership within the fixed Stage 1 candidate set using score propagation, adaptive neighborhood support filtering, and connectivity constraints. Across CADETS, THEIA, and OpTC-51, the framework achieves the highest mean F1 score among the compared methods under the protocol defined for each dataset. Evaluation with multiple roots across all three datasets returns compact evidence traceable to original audit records, while the selected paths retain most associated attack events and narrative stages.