STARE: A Lightweight APT Detection Approach based on Graph Neural Network

Advanced Persistent Threat (APT) has been a common attack mode that poses a significant threat to the security of the industrial internet. Their primary characteristics include concealment, persistence, and complexity. Most recent research leverages Graph Neural Network(GNN) trained on system log graphs to identify unknown attacks. However, these complex and time-consuming approaches are not suitable for the industrial internet. To address this issue, this paper proposes an APT detection approach STARE based on GNN. Specifically, we leverage node importance to steer the sampling procedure. The performance of the STARE approach compared with the advanced THREATRACE approach demonstrated that in nodelevel APT detection tasks, our approach achieved a $30 \%$ improvement in detection speed with minimal decrease in precision on the Streamspot dataset.