GNNFormer: capturing local interactions and long-term global dependencies for APT detection in provenance graphs

Advanced persistent threats (APTs) pose a formidable challenge in cybersecurity due to their stealthy, prolonged, and multi-stage attack techniques, which enable them to bypass many existing detection approaches. Despite considerable research efforts, most methods struggle to capture the complex dependencies and extended behavioral patterns that are essential for identifying these sophisticated threats. To address these challenges, we present GNNFormer, an end-to-end framework for APT detection that leverages provenance graph representation learning. GNNFormer embeds and processes system events within a unified architecture, capturing both local interactions and long-term global dependencies within the provenance graph to provide a comprehensive understanding of system behaviors. Furthermore, by employing a hierarchical attention mechanism, the framework dynamically prioritizes critical nodes and interactions, enhancing its focus on high-risk patterns while filtering out irrelevant information. Extensive evaluations on benchmark datasets demonstrate that GNNFormer significantly improves detection capabilities, establishing it as a scalable and effective solution for APT detection in complex cyber environments.