TGL-APT: Temporal Graph Learning with Graph Distillation for Efficient APT Investigation

• URL: http://arxiv.org/abs/2608.19750v1
• Date: Thu, 20 Aug 2026 07:54:28 GMT
• Title: TGL-APT: Temporal Graph Learning with Graph Distillation for Efficient APT Investigation
• Abstract summary: Advanced Persistent Threat (APT) attacks pose a critical challenge to modern systems.<n>Provenance graphs provide rich behavioral context for attack investigation.<n>Full-graph learning is both computationally expensive and difficult to correlate over long attack sequences.<n>We present TGL-APT, an adaptive investigation framework built on the observation that attack-relevant information is non-uniformly distributed.
• Score: 4.734580965992264
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Advanced Persistent Threat (APT) attacks pose a critical challenge to modern systems, as their stealthy, multi-stage nature renders conventional detection methods ineffective. While provenance graphs provide rich behavioral context for attack investigation, attack-relevant evidence is often sparse and embedded in large volumes of routine system activity, making full-graph learning both computationally expensive and difficult to correlate over long attack sequences. We present TGL-APT, an adaptive investigation framework built on the observation that attack-relevant information is non-uniformly distributed and often mediated by structurally influential or behaviorally distinctive entities, which we characterize as information-bottleneck nodes. TGL-APT combines three complementary components: (1) information-bottleneck-guided graph distillation that suppresses provenance redundancy while bounding structural distortion and preserving causal reachability; (2) adaptive temporal graph learning that continuously refines the core node set as node relevance evolves; and (3) cross-spatiotemporal attack fingerprint alignment that associates fragmented suspicious activities across different entities and time windows. Finally, causal expansion and stage characterization reconstruct coherent attack processes for investigation. Experiments on three DARPA E3 datasets show F1-scores of 95.7%, 90.9%, and 88.9%, while reducing training time, detection latency, and memory usage by approximately 39%, 33%, and 22%, respectively, compared with KAIROS. These results demonstrate that TGL-APT effectively balances detection performance, computational efficiency, and investigation capability for provenance-based APT analysis.

Related papers

• Boosting Robust AIGI Detection with LoRA-based Pairwise Training [55.076681464804636]
  Current AIGI detectors perform admirably on clean datasets, but their detection performance decreases when deployed "in the wild"<n>We propose a novel Lo-based Pairwise Training (RA) strategy designed specifically to achieve robust detection for AIGI under severe distortions.
  arXiv  Detail & Related papers  (2026-04-14T05:35:32Z)
• Learning the APT Kill Chain: Temporal Reasoning over Provenance Data for Attack Stage Estimation [0.0]
  This paper presents a temporal graph learning framework for multi-stage attack progression inference from fused host and network provenance data.<n> Experimental results demonstrate that StageFinder achieves a macro F1-score of 0.96 and reduces prediction volatility by 31 percent compared to state-of-the-art baselines.
  arXiv  Detail & Related papers  (2026-03-08T09:48:37Z)
• APT-CGLP: Advanced Persistent Threat Hunting via Contrastive Graph-Language Pre-Training [33.84587345029278]
  Provenance-based threat hunting identifies Advanced Persistent Threats (APTs) on endpoints by correlating attack patterns described in Cyber Threat Intelligence (CTI) with provenance graphs derived from system audit logs.<n>A fundamental challenge in this paradigm lies in the modality gap--the structural and semantic disconnect between provenance graphs and CTI reports.<n>We present APT-CGLP, a novel cross-modal APT hunting system via Contrastive Graph-Language Pre-training.
  arXiv  Detail & Related papers  (2025-11-25T13:20:12Z)
• TPPR: APT Tactic / Technique Pattern Guided Attack Path Reasoning for Attack Investigation [0.0]
  We propose TPPR, a novel framework that first extracts anomaly subgraphs through abnormal node detection, TTP-annotation and graph pruning.<n> TPPR's capability to achieve 99.9% graph simplification (700,000 to 20 edges) while preserving 91% of critical attack nodes, outperforming state-of-the-art solutions (SPARSE, DepImpact) by 63.1% and 67.9% in reconstruction precision while maintaining attack scenario integrity.
  arXiv  Detail & Related papers  (2025-10-25T07:13:07Z)
• TFLAG:Towards Practical APT Detection via Deviation-Aware Learning on Temporal Provenance Graph [7.676383564795898]
  Advanced Persistent Threat (APT) have grown increasingly complex and concealed.<n>Recent studies have incorporated graph learning techniques to extract detailed information from provenance graphs.<n>We introduce TFLAG, an advanced anomaly detection framework.
  arXiv  Detail & Related papers  (2025-01-13T01:08:06Z)
• Graph Transductive Defense: a Two-Stage Defense for Graph Membership Inference Attacks [50.19590901147213]
  Graph neural networks (GNNs) have become instrumental in diverse real-world applications, offering powerful graph learning capabilities. GNNs are vulnerable to adversarial attacks, including membership inference attacks (MIA) This paper proposes an effective two-stage defense, Graph Transductive Defense (GTD), tailored to graph transductive learning characteristics.
  arXiv  Detail & Related papers  (2024-06-12T06:36:37Z)
• LTRDetector: Exploring Long-Term Relationship for Advanced Persistent Threats Detection [20.360010908574303]
  Advanced Persistent Threat (APT) is challenging to detect due to prolonged duration, infrequent occurrence, and adept concealment techniques. Existing approaches primarily concentrate on the observable traits of attack behaviors, neglecting the intricate relationships formed throughout the persistent attack lifecycle. We present an innovative APT detection framework named LTRDetector, implementing an end-to-end holistic operation.
  arXiv  Detail & Related papers  (2024-04-04T02:30:51Z)
• The Adversarial Implications of Variable-Time Inference [47.44631666803983]
  We present an approach that exploits a novel side channel in which the adversary simply measures the execution time of the algorithm used to post-process the predictions of the ML model under attack. We investigate leakage from the non-maximum suppression (NMS) algorithm, which plays a crucial role in the operation of object detectors. We demonstrate attacks against the YOLOv3 detector, leveraging the timing leakage to successfully evade object detection using adversarial examples, and perform dataset inference.
  arXiv  Detail & Related papers  (2023-09-05T11:53:17Z)
• DiffSTG: Probabilistic Spatio-Temporal Graph Forecasting with Denoising Diffusion Models [53.67562579184457]
  This paper focuses on probabilistic STG forecasting, which is challenging due to the difficulty in modeling uncertainties and complex dependencies. We present the first attempt to generalize the popular denoising diffusion models to STGs, leading to a novel non-autoregressive framework called DiffSTG. Our approach combines the intrinsic-temporal learning capabilities STNNs with the uncertainty measurements of diffusion models.
  arXiv  Detail & Related papers  (2023-01-31T13:42:36Z)
• Temporal Difference Learning with Compressed Updates: Error-Feedback meets Reinforcement Learning [47.904127007515925]
  We study a variant of the classical temporal difference (TD) learning algorithm with a perturbed update direction. We prove that compressed TD algorithms, coupled with an error-feedback mechanism used widely in optimization, exhibit the same non-asymptotic approximation guarantees as their counterparts. Notably, these are the first finite-time results in RL that account for general compression operators and error-feedback in tandem with linear function approximation and Markovian sampling.
  arXiv  Detail & Related papers  (2023-01-03T04:09:38Z)
• A Robust Backpropagation-Free Framework for Images [47.97322346441165]
  We present an error kernel driven activation alignment algorithm for image data. EKDAA accomplishes through the introduction of locally derived error transmission kernels and error maps. Results are presented for an EKDAA trained CNN that employs a non-differentiable activation function.
  arXiv  Detail & Related papers  (2022-06-03T21:14:10Z)
• Graph Backdoor [53.70971502299977]
  We present GTA, the first backdoor attack on graph neural networks (GNNs) GTA departs in significant ways: it defines triggers as specific subgraphs, including both topological structures and descriptive features. It can be instantiated for both transductive (e.g., node classification) and inductive (e.g., graph classification) tasks.
  arXiv  Detail & Related papers  (2020-06-21T19:45:30Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.