Search papers, labs, and topics across Lattice.
TGL-APT introduces an adaptive investigation framework that leverages information-bottleneck-guided graph distillation to enhance the efficiency of Advanced Persistent Threat (APT) investigations. By focusing on structurally influential nodes and refining core node sets over time, the method significantly reduces the computational burden associated with full-graph learning while maintaining high detection performance. Experiments reveal that TGL-APT achieves F1-scores exceeding 90% across multiple datasets, while also decreasing training time, detection latency, and memory usage by substantial margins compared to existing methods like KAIROS.
TGL-APT achieves over 95% F1-score while cutting training time and memory usage by nearly 40%, revolutionizing APT investigation efficiency.
Advanced Persistent Threat (APT) attacks pose a critical challenge to modern systems, as their stealthy, multi-stage nature renders conventional detection methods ineffective. While provenance graphs provide rich behavioral context for attack investigation, attack-relevant evidence is often sparse and embedded in large volumes of routine system activity, making full-graph learning both computationally expensive and difficult to correlate over long attack sequences. We present TGL-APT, an adaptive investigation framework built on the observation that attack-relevant information is non-uniformly distributed and often mediated by structurally influential or behaviorally distinctive entities, which we characterize as information-bottleneck nodes. TGL-APT combines three complementary components: (1) information-bottleneck-guided graph distillation that suppresses provenance redundancy while bounding structural distortion and preserving causal reachability; (2) adaptive temporal graph learning that continuously refines the core node set as node relevance evolves; and (3) cross-spatiotemporal attack fingerprint alignment that associates fragmented suspicious activities across different entities and time windows. Finally, causal expansion and stage characterization reconstruct coherent attack processes for investigation. Experiments on three DARPA E3 datasets show F1-scores of 95.7%, 90.9%, and 88.9%, while reducing training time, detection latency, and memory usage by approximately 39%, 33%, and 22%, respectively, compared with KAIROS. These results demonstrate that TGL-APT effectively balances detection performance, computational efficiency, and investigation capability for provenance-based APT analysis.
