Learning the APT Kill Chain: Temporal Reasoning over Provenance Data for Attack Stage Estimation

• URL: http://arxiv.org/abs/2603.07560v1
• Date: Sun, 08 Mar 2026 09:48:37 GMT
• Title: Learning the APT Kill Chain: Temporal Reasoning over Provenance Data for Attack Stage Estimation
• Abstract summary: This paper presents a temporal graph learning framework for multi-stage attack progression inference from fused host and network provenance data.<n> Experimental results demonstrate that StageFinder achieves a macro F1-score of 0.96 and reduces prediction volatility by 31 percent compared to state-of-the-art baselines.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Advanced Persistent Threats (APTs) evolve through multiple stages, each exhibiting distinct temporal and structural behaviors. Accurate stage estimation is critical for enabling adaptive cyber defense. This paper presents StageFinder, a temporal graph learning framework for multi-stage attack progression inference from fused host and network provenance data. Provenance graphs are encoded using a graph neural network to capture structural dependencies among processes, files, and connections, while a long short-term memory (LSTM) model learns temporal dynamics to estimate stage probabilities aligned with the MITRE ATT&CK framework. The model is pretrained on the DARPA OpTC dataset and fine-tuned on labeled DARPA Transparent Computing data. Experimental results demonstrate that StageFinder achieves a macro F1-score of 0.96 and reduces prediction volatility by 31 percent compared to state-of-the-art baselines (Cyberian, NetGuardian). These results highlight the effectiveness of fused provenance and temporal learning for accurate and stable APT stage inference.

Related papers

• TGL-APT: Temporal Graph Learning with Graph Distillation for Efficient APT Investigation [4.734580965992264]
  Advanced Persistent Threat (APT) attacks pose a critical challenge to modern systems.<n>Provenance graphs provide rich behavioral context for attack investigation.<n>Full-graph learning is both computationally expensive and difficult to correlate over long attack sequences.<n>We present TGL-APT, an adaptive investigation framework built on the observation that attack-relevant information is non-uniformly distributed.
  arXiv  Detail & Related papers  (2026-08-20T07:54:28Z)
• Deep Recurrent Hidden Markov Learning Framework for Multi-Stage Advanced Persistent Threat Prediction [0.0538441598991272]
  Advanced Persistent Threats (APTs) represent hidden, multistage cyberattacks whose long term persistence and adaptive behavior challenge conventional intrusion detection systems (IDS)<n>This paper proposes E-HiDNet, a unified hybrid deep probabilistic learning framework that integrates convolutional and recurrent neural networks with a Hidden Markov Model (HMM) to allow accurate prediction of the progression of the APT campaign.<n> Simulation results show that E-HiDNet achieves up to 98.8-100% accuracy in stage prediction and significantly outperforms standalone HMMs when four or more observations are available.
  arXiv  Detail & Related papers  (2026-01-11T01:01:10Z)
• Estimating Time Series Foundation Model Transferability via In-Context Learning [74.65355820906355]
  Time series foundation models (TSFMs) offer strong zero-shot forecasting via large-scale pre-training.<n>Fine-tuning remains critical for boosting performance in domains with limited public data.<n>We introduce TimeTic, a transferability estimation framework that recasts model selection as an in-context-learning problem.
  arXiv  Detail & Related papers  (2025-09-28T07:07:13Z)
• FedTeddi: Temporal Drift and Divergence Aware Scheduling for Timely Federated Edge Learning [12.104759384825705]
  Federated edge learning (FEEL) enables collaborative model training across distributed clients over wireless networks without exposing raw data.<n>A critical challenge is how to adapt models in a timely yet efficient manner to such evolving data.<n>We propose FedTeddi, a temporal-drift-and-divergence-aware scheduling algorithm that facilitates fast convergence of FEEL.
  arXiv  Detail & Related papers  (2025-09-09T02:33:48Z)
• Accurate Multi-Category Student Performance Forecasting at Early Stages of Online Education Using Neural Networks [2.195766695109612]
  This study introduces a novel neural network-based approach capable of accurately predicting student performance.<n>The proposed model predicts outcomes in Distinction, Fail, Pass, and Withdrawn categories.<n>The results indicate that the prediction accuracy of the proposed method is about 25% more than the existing state-of-the-art.
  arXiv  Detail & Related papers  (2024-12-08T13:37:30Z)
• Drift-Resilient TabPFN: In-Context Learning Temporal Distribution Shifts on Tabular Data [39.40116554523575]
  We present Drift-Resilient TabPFN, a fresh approach based on In-Context Learning with a Prior-Data Fitted Network. It learns to approximate Bayesian inference on synthetic datasets drawn from a prior. It improves accuracy from 0.688 to 0.744 and ROC AUC from 0.786 to 0.832 while maintaining stronger calibration.
  arXiv  Detail & Related papers  (2024-11-15T23:49:23Z)
• Neural Networks with LSTM and GRU in Modeling Active Fires in the Amazon [0.0]
  This study presents a comprehensive methodology for modeling and forecasting the historical time series of active fire spots detected by the AQUA_M-T satellite in the Amazon, Brazil. The approach employs a mixed Recurrent Neural Network (RNN) model, combining Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) architectures to predict the monthly accumulations of daily detected active fire spots.
  arXiv  Detail & Related papers  (2024-09-04T13:11:59Z)
• Assessing Neural Network Representations During Training Using Noise-Resilient Diffusion Spectral Entropy [55.014926694758195]
  Entropy and mutual information in neural networks provide rich information on the learning process. We leverage data geometry to access the underlying manifold and reliably compute these information-theoretic measures. We show that they form noise-resistant measures of intrinsic dimensionality and relationship strength in high-dimensional simulated data.
  arXiv  Detail & Related papers  (2023-12-04T01:32:42Z)
• The effect of data augmentation and 3D-CNN depth on Alzheimer's Disease detection [51.697248252191265]
  This work summarizes and strictly observes best practices regarding data handling, experimental design, and model evaluation. We focus on Alzheimer's Disease (AD) detection, which serves as a paradigmatic example of challenging problem in healthcare. Within this framework, we train predictive 15 models, considering three different data augmentation strategies and five distinct 3D CNN architectures.
  arXiv  Detail & Related papers  (2023-09-13T10:40:41Z)
• Robust Learning with Progressive Data Expansion Against Spurious Correlation [65.83104529677234]
  We study the learning process of a two-layer nonlinear convolutional neural network in the presence of spurious features. Our analysis suggests that imbalanced data groups and easily learnable spurious features can lead to the dominance of spurious features during the learning process. We propose a new training algorithm called PDE that efficiently enhances the model's robustness for a better worst-group performance.
  arXiv  Detail & Related papers  (2023-06-08T05:44:06Z)
• Continual Spatio-Temporal Graph Convolutional Networks [87.86552250152872]
  We reformulating the Spatio-Temporal Graph Convolutional Neural Network as a Continual Inference Network. We observe up to 109x reduction in time complexity, on- hardware accelerations of 26x, and reductions in maximum allocated memory of 52% during online inference.
  arXiv  Detail & Related papers  (2022-03-21T14:23:18Z)
• Networked Time Series Prediction with Incomplete Data [59.45358694862176]
  We propose NETS-ImpGAN, a novel deep learning framework that can be trained on incomplete data with missing values in both history and future. We conduct extensive experiments on three real-world datasets under different missing patterns and missing rates.
  arXiv  Detail & Related papers  (2021-10-05T18:20:42Z)
• Convolutional Tensor-Train LSTM for Spatio-temporal Learning [116.24172387469994]
  We propose a higher-order LSTM model that can efficiently learn long-term correlations in the video sequence. This is accomplished through a novel tensor train module that performs prediction by combining convolutional features across time. Our results achieve state-of-the-art performance-art in a wide range of applications and datasets.
  arXiv  Detail & Related papers  (2020-02-21T05:00:01Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.