GNN-Based Multi-Source Heterogeneous Data Representation and Compression for APT Detection

Abstract

Advanced Persistent Threats (APTs) pose severe challenges to cybersecurity defense due to their stealthiness and persistence. To address the complexity of multi-source heterogeneous data representation, the large scale of provenance graphs, and the extreme class imbalance in APT scenarios, this paper proposes a Graph Neural Network (GNN)-based method for heterogeneous provenance graph representation and compression. A label-driven $K$-hop (multi-hop) subgraph sampling strategy is introduced to reduce graph size and mitigate label imbalance, complemented by a cluster-balanced negative sampling mechanism. To address redundant multi-edges in the same direction, we design a frequency-based edge aggregation and compression approach, which reduces computational overhead and alleviates over-smoothing in the GNN. A heterogeneous attention-based GNN is further designed to learn node embeddings by integrating multi-relational information, followed by an eXtreme Gradient Boosting (XGBoost) classifier for APT node detection. Experiments on the CIC Advanced Persistent Threat - Industrial Internet of Things (CIC-APT-IIoT) dataset demonstrate that the proposed method significantly improves detection performance (e.g., Precision, Recall, and F1-score) while reducing modeling overhead, showing strong generalization ability and practical potential. Nevertheless, the current evaluation mainly focuses on the selected benchmark dataset. Further validation on larger-scale provenance graphs, streaming security logs, and more diverse deployment scenarios is required to comprehensively assess practical scalability.