Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models

2026-07-22

AI Summary

Advanced Persistent Threat (APT) detection faces significant challenges in cost and scalability due to sparse logs, reliance on manual annotation, and complex preprocessing pipelines. This work proposes CAPTAIN, a novel approach that introduces context-enhanced perplexity for APT detection for the first time. Built upon a general-purpose pretrained language model, CAPTAIN employs a Q-Former–style bridging module to encode recent log history and injects its compressed contextual representation into the decoder. By integrating temporal perplexity with smoothing filters, the method enables end-to-end unsupervised anomaly detection with minimal preprocessing. Evaluated across multiple APT benchmarks, CAPTAIN achieves performance comparable to strong supervised baselines while substantially reducing engineering and operational overhead.

Abstract

Advanced Persistent Threats (APTs) remain difficult to detect because only a small fraction of events in large-scale logs are attack-related, and investigation is expensive and hard to scale. Prior machine-learning approaches can reduce analyst workload, but they often rely on heavily curated training data and sophisticated preprocessing pipelines. Building and maintaining such pipelines require substantial domain expertise and engineering cost. Motivated by insights from a study of a strong APT detection baseline, we propose CAPTAIN (Context-Augmented Perplexity-based Threat Activity log detectIoN), a perplexity-based detector that leverages general, pre-trained language models with minimal, domain-agnostic preprocessing, enabling robust scoring of long, minimally processed log entries. CAPTAIN encodes recent history with an encoder model and a Q-Former-style bridge, then injects the compact context tokens into the decoder input so that perplexity reflects temporal context. To improve stability, CAPTAIN additionally applies smoothing filters to the perplexity time series. Across APT-oriented benchmarks, CAPTAIN competes with strong existing baselines and remains robust under substantially less curated inputs, that reduces the development and operational cost of advanced log preprocessing.

Problem

• Advanced Persistent Threats
• log curation
• APT detection
• unsupervised detection
• perplexity-based detection

Innovation

• perplexity-based detection
• unsupervised APT detection
• context-augmented language models
• log preprocessing reduction
• Q-Former bridge