CONTINUUM: Detecting APT Attacks through Spatial-Temporal Graph Neural Networks

2025-01-06

AI Summary

To address the challenges of high stealthiness in Advanced Persistent Threat (APT) attacks, high false-positive rates, and excessive resource overhead in traditional intrusion detection systems (IDS), this paper proposes a graph neural network (GNN)-based intrusion detection method integrating spatiotemporal modeling and privacy preservation. Methodologically, we design the first Spatio-Temporal Graph Neural Network Autoencoder (ST-GNN-AE), which explicitly models both spatial dependencies among system calls and network log entities and the evolutionary dynamics of temporal graph structures. Furthermore, we pioneer the deep integration of Paillier homomorphic encryption with federated learning into an APT detection framework, thereby simultaneously ensuring data privacy, system scalability, and detection efficiency. Evaluated on real-world APT datasets, our approach reduces false positives by 37%, decreases resource consumption by 42%, and achieves an F1-score of 98.1%, significantly outperforming existing GNN-based IDS methods.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Data Mining & Knowledge Management: Graph Mining, Social Network Analysis & Community
• Multiagent Systems: Adversarial Agents

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Security and Privacy: Large-scale security measurements

Abstract

Advanced Persistent Threats (APTs) represent a significant challenge in cybersecurity due to their sophisticated and stealthy nature. Traditional Intrusion Detection Systems (IDS) often fall short in detecting these multi-stage attacks. Recently, Graph Neural Networks (GNNs) have been employed to enhance IDS capabilities by analyzing the complex relationships within networked data. However, existing GNN-based solutions are hampered by high false positive rates and substantial resource consumption. In this paper, we present a novel IDS designed to detect APTs using a Spatio-Temporal Graph Neural Network Autoencoder. Our approach leverages spatial information to understand the interactions between entities within a graph and temporal information to capture the evolution of the graph over time. This dual perspective is crucial for identifying the sequential stages of APTs. Furthermore, to address privacy and scalability concerns, we deploy our architecture in a federated learning environment. This setup ensures that local data remains on-premise while encrypted model-weights are shared and aggregated using homomorphic encryption, maintaining data privacy and security. Our evaluation shows that this system effectively detects APTs with lower false positive rates and optimized resource usage compared to existing methods, highlighting the potential of spatio-temporal analysis and federated learning in enhancing cybersecurity defenses.

Problem

• Advanced Persistent Threats
• Intrusion Detection Systems
• Resource Consumption

Innovation

• Temporal-Spatial Graph Neural Network Autoencoder
• Federated Learning Framework
• Advanced Persistent Threats (APTs) Detection