Scholarlink

<p>With the increasing stealth and severity of cyberattacks, the demand for advanced persistent threat (APT) detection systems that deeply understand complex system behaviors has grown substantially. However, existing provenance-based methods often struggle to balance prediction accuracy with inference latency across distributed, resource-constrained environments. To address this, we propose <b>CE-GTC</b>, a collaborative intelligence framework that synergizes large and small models across the cloud-edge continuum. Specifically, the system constructs provenance graphs to capture causal system interactions. In the cloud, a heavy Graph Transformer (the large model) performs computationally intensive representation learning—utilizing edge-feature injection and self-supervised objectives—to extract discriminative embeddings and compact normal behavior profiles. Meanwhile, edge devices host a lightweight clustering detector (the small model) for real-time, privacy-aware anomaly detection via Inverse Document Frequency (IDF)-weighted hybrid distance computation against multi-cluster centers. Experimental evaluations on the Unicorn Wget and StreamSpot datasets demonstrate that <b>CE-GTC</b> achieves superior performance, including an F1-score up to 0.974 and response latency under one second. This highlights the effectiveness of large-small model synergy for scalable, secure, and intelligent APT detection.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Collaborative APT detection through cloud-edge synergy of graph transformer and lightweight clustering

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年6月18日

查看全文
  • Chong Ruan,
  • Chunsun Tian,
  • Zhijun Liu,
  • Dan Wang,
  • Po Wu,
  • Lei Yang

摘要

With the increasing stealth and severity of cyberattacks, the demand for advanced persistent threat (APT) detection systems that deeply understand complex system behaviors has grown substantially. However, existing provenance-based methods often struggle to balance prediction accuracy with inference latency across distributed, resource-constrained environments. To address this, we propose CE-GTC, a collaborative intelligence framework that synergizes large and small models across the cloud-edge continuum. Specifically, the system constructs provenance graphs to capture causal system interactions. In the cloud, a heavy Graph Transformer (the large model) performs computationally intensive representation learning—utilizing edge-feature injection and self-supervised objectives—to extract discriminative embeddings and compact normal behavior profiles. Meanwhile, edge devices host a lightweight clustering detector (the small model) for real-time, privacy-aware anomaly detection via Inverse Document Frequency (IDF)-weighted hybrid distance computation against multi-cluster centers. Experimental evaluations on the Unicorn Wget and StreamSpot datasets demonstrate that CE-GTC achieves superior performance, including an F1-score up to 0.974 and response latency under one second. This highlights the effectiveness of large-small model synergy for scalable, secure, and intelligent APT detection.