STAE-APT: An APT Detection Method Based on Long-Term Behavioral Features from Provenance Graphs

Due to the characteristics of long-term latency and multi-stage attacks, long-term behavioral features are crucial for Advanced Persistent Threat (APT) detection. Existing research struggles to effectively extract long-term behavioral features and suffers from slow detection speeds. To address these issues, we introduce STAE-APT, a novel APT detection method leveraging provenance graph analysis. This method utilizes a Temporal Convolutional Network (TCN)-enhanced autoencoder (TCN-AE) to capture global temporal information. Simultaneously, a channel attention mechanism is introduced to highlight local critical behavioral features, thereby enhancing the feature representation capability for long-term behaviors. Furthermore, the parallel convolution characteristic of the TCN model is leveraged to significantly improve the detection speed. Evaluations on four public datasets, compared against methods like UNICORN and SeqNet, demonstrate STAE-APT’s superior performance, achieving accuracies of $99.88 \%, 99.5 \%, 99.1 \%$, and $98.38 \%$, respectively, alongside a $\mathbf{4 0 \%}$ reduction in detection time.