A Novel Approach for Advanced Persistent Threats Detection via Graph Transformer
摘要
Advanced Persistent Threats (APTs) pose significant challenges to cybersecurity since they always represent furtive and sophisticated. Prior researches often fall short in detecting unknown attack and long-chain attack. This paper presents a novel approach named DetecFormer, leveraging Graph Transformers to detect APT through provenance graph analysis. Our method addresses the limitations of Graph Neural Networks in capturing long-range dependencies in provenance graphs. By introducing global attention mechanisms, our approach effectively captures long-range dependencies, enhancing detection accuracy. Additionally, by utilizing Masked Auto-Encoder, our model is able to identify unknown threats. We evaluate our model against state-of-the-art methods, resulting DetecFormer outstanding detection results in all scenarios and in terms of effectiveness, it has great advantages compared with the most advanced APT detection methods.