Zhenye Zhao
← All research
BLOCK 042023–24· First author, undergraduate thesis

APT Intrusion Detection with Provenance Graphs

Signature-free detection of advanced persistent threats by embedding whole-system provenance graphs.

Year
2023–24
Role
First author, undergraduate thesis
Status
Archived

Fig. 01 · 2023–24

A whole-system provenance graph with the detected attack path highlighted in red, running from the initial compromised process through to the exfiltrated file.
Signature-free detection: the red path is the attack chain the model reconstructs, which an analyst can read directly after detection.
Advanced persistent threats leave behavioural traces rather than signatures, so the detection problem becomes a graph problem: given a whole-system provenance graph, decide whether an attack is in progress.
The model is a GNN encoder-decoder built on UniMP and MLP for dynamic graph learning, which lets it detect APT activity on provenance graphs in real time without predefined signatures. On the DARPA E3-CADETS dataset it reaches 100% recall at 98% accuracy.
The system also reconstructs attack footprints into compact attack summary graphs, so an analyst can reason about the intrusion after it is detected rather than only being told that something happened.
First-author bachelor's thesis, Department of Computer Science and Technology, Nanjing University.