Advanced Persistent Threats (APTs) pose significant challenges to cybersecurity since they always represent furtive and sophisticated. Prior researches often fall short in detecting unknown attack and long-chain attack. This paper presents a novel approach named DetecFormer, leveraging Graph Transformers to detect APT through provenance graph analysis. Our method addresses the limitations of Graph Neural Networks in capturing long-range dependencies in provenance graphs. By introducing global attention mechanisms, our approach effectively captures long-range dependencies, enhancing detection accuracy. Additionally, by utilizing Masked Auto-Encoder, our model is able to identify unknown threats. We evaluate our model against state-of-the-art methods, resulting DetecFormer outstanding detection results in all scenarios and in terms of effectiveness, it has great advantages compared with the most advanced APT detection methods.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

A Novel Approach for Advanced Persistent Threats Detection via Graph Transformer

  • Ziyi Luo,
  • Jianye Yang,
  • Ouyang Dian

摘要

Advanced Persistent Threats (APTs) pose significant challenges to cybersecurity since they always represent furtive and sophisticated. Prior researches often fall short in detecting unknown attack and long-chain attack. This paper presents a novel approach named DetecFormer, leveraging Graph Transformers to detect APT through provenance graph analysis. Our method addresses the limitations of Graph Neural Networks in capturing long-range dependencies in provenance graphs. By introducing global attention mechanisms, our approach effectively captures long-range dependencies, enhancing detection accuracy. Additionally, by utilizing Masked Auto-Encoder, our model is able to identify unknown threats. We evaluate our model against state-of-the-art methods, resulting DetecFormer outstanding detection results in all scenarios and in terms of effectiveness, it has great advantages compared with the most advanced APT detection methods.