TGL-APT: Temporal Graph Learning with Graph Distillation for Efficient APT Investigation

TGL-APT: Temporal Graph Learning with Graph Distillation for Efficient APT Investigation Ayong Ye*

Jing Chen

arXiv:2608.19750v1 [cs.CR] 20 Aug 2026

Fujian Normal University qbx20240213@yjs.fjnu.edu.cn

Yuanhuang Liu

Yuexin Zhang

Fujian Normal University Fujian Normal University Fujian Normal University qsx20231394@student.fjnu.edu.cn yxzhang@fjnu.edu.cn yay@fjnu.edu.cn * Corresponding author

Abstract—Advanced Persistent Threat (APT) attacks pose a critical challenge to modern systems, as their stealthy, multistage nature renders conventional detection methods ineffective. While provenance graphs provide rich behavioral context for attack investigation, attack-relevant evidence is often sparse and embedded in large volumes of routine system activity, making full-graph learning both computationally expensive and difficult to correlate over long attack sequences. We present TGL-APT, an adaptive investigation framework built on the observation that attack-relevant information is non-uniformly distributed and often mediated by structurally influential or behaviorally distinctive entities, which we characterize as information-bottleneck nodes. TGL-APT combines three complementary components: (1) information-bottleneck-guided graph distillation that suppresses provenance redundancy while bounding structural distortion and preserving causal reachability; (2) adaptive temporal graph learning that continuously refines the core node set as node relevance evolves; and (3) cross-spatiotemporal attack fingerprint alignment that associates fragmented suspicious activities across different entities and time windows. Finally, causal expansion and stage characterization reconstruct coherent attack processes for investigation. Experiments on three DARPA E3 datasets show F1scores of 95.7%, 90.9%, and 88.9%, while reducing training time, detection latency, and memory usage by approximately 39%, 33%, and 22%, respectively, compared with KAIROS. These results demonstrate that TGL-APT effectively balances detection performance, computational efficiency, and investigation capability for provenance-based APT analysis.

I. I NTRODUCTION Advanced Persistent Threat (APT) attacks, with the characteristics of stealthiness, long-term latency, and multi-stage infiltration, have become one of the most serious threats to critical infrastructure and information systems [1]. Traditional signature-based detection tools can hardly cope with the lowfrequency, slow-changing, and highly concealed behaviors of APT attacks. System provenance graphs constructed from audit logs have become the mainstream paradigm for APT traceability due to their ability to record entity dependencies and behavioral processes [2]. Recent provenance-based approaches have substantially advanced APT detection by modeling structural and temporal dependencies in system activities. In particular, graph-learningbased methods learn representations of processes, files, and network interactions from provenance graphs, while temporal approaches further capture the evolution of system behavior for anomaly detection and attack investigation [3]–[5]. These

methods demonstrate the effectiveness of provenance-based temporal modeling for detecting stealthy attacks that are difficult to identify from isolated events. However, the increasing scale of provenance data creates a fundamental signal-to-noise dilemma for APT detection. In particular, provenance-based APT analysis exhibits a data paradox: collecting more system activities provides richer behavioral context, yet attack-relevant evidence remains sparse, causing its effective signal-to-noise ratio to decrease as routine provenance accumulates. Long-running systems may generate millions of nodes and edges, while attack-related evidence is easily obscured by repetitive benign activities. Consequently, full-graph learning not only incurs substantial computational overhead [3]–[5], but also processes large amounts of information with limited security relevance. Meanwhile, indiscriminate graph reduction may discard rare but critical entities or break causal dependencies [6], [7]. These limitations raise a more fundamental question: what information in a provenance graph is actually necessary for preserving attackrelevant evidence? Existing full-graph learning and generic graph reduction do not explicitly answer this question. In provenance graphs, attack evidence is often sparse and non-uniformly distributed, tending to concentrate around a limited set of structurally influential or behaviorally distinctive entities. Moreover, as an APT campaign evolves, the entities carrying such evidence may change over time, causing related activities to appear across different processes, files, network endpoints, and time windows. Such temporal relevance drift makes a statically distilled node set increasingly mismatched to the evolving attack context. This temporal dispersion makes entity co-occurrence insufficient for correlating related activities and may fragment a continuous attack into disconnected anomaly sequences [5], [8]–[10]. Even when suspicious events are detected, isolated anomalies alone cannot reveal their causal dependencies or progression across attack stages [11], [12]. Therefore, the key challenge is to understand where attack-relevant information is concentrated, how its importance evolves over time, and how distributed evidence can be connected into a coherent attack process. To address this question, we formulate provenance distillation from an information-bottleneck perspective and propose TGL-APT, a temporal graph learning framework that

progressively extracts, tracks, and associates attack-relevant information from large-scale provenance data. The framework first employs information-bottleneck-guided graph distillation to identify structurally and behaviorally informative entities and preserve their critical causal context while suppressing redundant system activities. It then uses an adaptive focus mechanism to dynamically refine the core node set according to model-derived signals, enabling the analysis focus to follow changes in information relevance over time. To recover attack evidence fragmented across different entities and time windows, cross-spatiotemporal fingerprint alignment combines entity-level and semantic correlations to connect related suspicious activities. Finally, causal expansion and stage characterization reconstruct the correlated evidence into coherent attack chains and identify attack stages, transforming fragmented anomalies into interpretable investigation results. The main contributions are summarized as follows: (1) We formulate provenance-based APT investigation from an Information Bottleneck perspective and formally characterize IB nodes from information-theoretic, graph-topological, and temporal perspectives. We further establish a structuralcausal preservation and downstream stability bound, providing theoretical support for preserving attack-relevant information during graph distillation. (2) We propose TGL-APT, an efficient and adaptive framework that addresses the limitations of static graph reduction. Its Adaptive Focus Mechanism dynamically updates critical nodes using model-derived attention weights and embedding deviations, enabling the analysis focus to follow evolving attack-relevant information over time. (3) To address the “synonymous but heterogeneous” nature of attack behaviors across different entities and time windows, we design a cross-spatiotemporal attack fingerprint alignment method. By combining TF-IDF-weighted fingerprints with contrastive learning, TGL-APT associates semantically related suspicious activities across temporal windows without requiring direct entity co-occurrence. (4) We conduct extensive experiments on three DARPA E3 datasets. TGL-APT achieves F1-scores of up to 95.7% while reducing training time, detection latency, and memory usage by approximately 39%, 33%, and 22%, respectively, compared with KAIROS. The investigation results further demonstrate its capability to reconstruct fragmented suspicious activities into interpretable attack stages.

predefined rules, or statistical deviations from normal system behavior. Heuristic-based approaches [15]–[20] identify suspicious activities using known attack patterns, provenance dependencies, or threat knowledge. Holmes [15] maps lowlevel system events to expert-defined TTPs and constructs high-level attack scenarios, while SLEUTH [17] reconstructs attack scenarios from audit data. Poirot [16] aligns known attack behavior with kernel audit records for threat hunting, and LMTracker [19] models lateral movement paths using heterogeneous graph representations. APT-KGL [20] further combines threat knowledge with heterogeneous provenance graph learning. Commercial detection systems also commonly organize attack knowledge using MITRE ATT&CK TTPs [21]. APT-MMF [22] exploits multimodal and multilevel information for APT actor attribution. Anomaly-based approaches reduce the dependence on predefined attack signatures by learning normal system behavior [10], [23]–[25]. StreamSpot [23] performs memory-efficient anomaly detection over streaming heterogeneous graphs, while Unicorn [24] detects abnormal runtime provenance patterns. Related learning-based security classification methods [26], [27] also address detection under highly imbalanced security data. Despite their effectiveness, knowledge-driven methods remain dependent on known attack patterns, whereas conventional anomaly detection has limited ability to capture complex temporal dependencies and multi-hop interactions. These limitations motivate richer graph representations that can model how suspicious activities propagate through provenance dependencies over time. 2) Graph Learning and Provenance Reduction: Graph neural networks have increasingly been used to model complex structural and temporal dependencies in provenance data. ThreaTrace [25] applies GraphSAGE [28] to provenance graphs for node-level threat detection and tracing. MAGIC [3] employs self-supervised masked graph learning to model benign behavior and accommodate changes in system activity. KAIROS [5] uses a temporal graph encoder-decoder to capture provenance evolution and identify anomalous interactions. More recent temporal approaches such as TFLAG [29] further exploit deviations in historical behavior for APT detection. Although graph learning improves structural and temporal modeling, long-running provenance graphs may contain millions of nodes and edges, while attack-relevant evidence remains sparse and embedded in large volumes of routine system activity. Processing such graphs in full therefore incurs substantial computational and memory overhead. Sampling and graph reduction can alleviate this problem [6], [8], [30], but reducing provenance solely according to graph size or generic structural properties may remove low-frequency but security-relevant entities or break causal dependencies needed for subsequent analysis. 3) Attack Correlation and Investigation: Beyond detecting suspicious events, APT investigation aims to connect distributed evidence and reconstruct the underlying attack process. Holmes [15] and Poirot [16] correlate suspicious

II. BACKGROUND AND R ELATED W ORK A. Research Status Existing studies on APT detection and investigation mainly rely on system logs and provenance graphs [13], [14]. According to their main objectives, we group existing approaches into three categories: provenance-based APT detection, graph learning and provenance reduction, and attack correlation and investigation. 1) Provenance-based APT Detection: Early provenancebased detection methods mainly rely on expert knowledge,

2

information flows or threat knowledge with system provenance to recover attack-related behavior. APTSHIELD [31] organizes APT behavior into multiple attack stages and generates alerts through rule-based analysis. TAGAPT [32] operates on provenance-level attack graphs to support attack-stage analysis. ORTHRUS [12] performs forward and backward provenance analysis to identify important dependencies for attack attribution. KAIROS [5] applies Louvain community detection [33] to organize highly anomalous activities into suspicious subgraphs, while Slot [34] employs graph reinforcement learning for provenance-driven APT detection and TTP analysis. However, long-running APT campaigns may span different processes, files, network endpoints, and time windows. Related attack activities therefore do not necessarily share the same entities, making entity-based correlation insufficient when attack semantics remain similar but their concrete carriers change. Moreover, suspicious events or subgraphs alone do not reveal the complete causal progression and stage transitions of an attack. Consequently, effective investigation requires both cross-window association of fragmented evidence and causal organization of the resulting suspicious activities. Overall, existing approaches address provenance detection, graph-scale reduction, and attack investigation largely as separate problems. Detection models capture increasingly rich system behavior but must process substantial redundant activity; graph reduction improves efficiency but may lose sparse security-relevant evidence; and investigation methods may fail to connect related behaviors when evidence shifts across entities and time windows. These limitations motivate a unified approach that identifies, preserves, tracks, and connects attack-relevant information throughout provenance-based APT analysis.

progression. Recovering causal paths and identifying representative stage transitions can transform fragmented suspicious activities into coherent and interpretable attack processes. Overall, this study focuses on identifying, preserving, tracking, and connecting sparse attack-relevant information throughout provenance-based APT analysis, with the goal of improving detection efficiency, long-range correlation, and attack investigation. III. M ETHODOLOGY TGL-APT detects and investigates stealthy multi-stage APT attacks from large-scale dynamic audit logs. It learns normal system behavior from benign training data without requiring malicious labels and operates on reliably collected audit records, where malicious activities may be concealed within benign behavior. As shown in Figure 1, TGL-APT progressively extracts attack-relevant information through graph distillation, adaptive temporal learning, and cross-spatiotemporal alignment, followed by causal reconstruction and attack-stage identification. A. Problem Formulation Let Graw = (Vraw , Eraw , T, A) denote a dynamic provenance graph containing system entities, dependency edges, timestamps, and attributes, and let Gcomp = D(Graw ) denote its distilled representation. The objective of provenance distillation is not merely to reduce graph size, but to remove redundant system information while retaining the evidence required for downstream APT detection and investigation. Let Y represent the security-relevant information needed for downstream APT detection and investigation. We then formulate graph distillation under the Information Bottleneck principle [35] as LIB = I(Graw ; Gcomp ) − λI(Gcomp ; Y ),

B. Research Motivation

(1)

where minimizing LIB encourages removing redundant information by minimizing I(Graw ; Gcomp ), while preserving taskrelevant information by maximizing I(Gcomp ; Y ) through the negative second term. Direct estimation of these mutual-information terms is intractable for large dynamic heterogeneous provenance graphs. We therefore make this objective operational using tractable proxies for redundancy and task relevance. At the node level, task relevance is characterized from two complementary aspects: structural mediation C(v), which captures the role of node v in connecting provenance dependencies, and behavioral specificity R(v), which captures the distinctiveness of its interaction pattern. We define

The motivation of this study stems from three challenges in provenance-based APT analysis: sparse attack-relevant evidence hidden in large volumes of routine system activity, evolving information relevance that weakens long-term correlation, and fragmented anomalies that provide limited support for attack investigation. To reduce provenance redundancy without losing critical evidence, graph reduction should consider not only graph size, but also the structural and behavioral relevance of retained entities and the causal context surrounding them. This provides a more suitable basis for efficient temporal graph learning than indiscriminate graph compression. For long-running analysis, the entities carrying attackrelevant information may change over time, while related activities may appear across different processes, files, network endpoints, and time windows. This requires the analysis focus to adapt to changing node relevance and to associate suspicious activities beyond simple entity co-occurrence. For attack investigation, isolated anomalies must be further organized according to their causal dependencies and temporal

Score(v) = αC(v) + βR(v),

(2)

which provides a tractable measure of node-level information relevance. Accordingly, the practical distillation objective is formulated as X min Ω(Gcomp ) − µ Score(v), (3) Gcomp ⊆Graw

3

v∈Vcomp

① Graph Construction and Distillation Graph Distillation 3

4

6

1

2

7

5

8

Time Window 1

Core Nodes 2

0.85

7

0.4

1

3

4

6

1

2

7

5

8

Time Window 2

Time Window 3

③ Anomaly Detection

④ Attack Investigation

0.4

…

…

8

0.1

Generate

② Temporal Graph Learning

T1

2

TGAT Encoder

7 1 8

MLP Decoder

5 3 6 8 Entity, Weight, Feature

2 7 1

0.85 0.4 0.4

2 7 8

(T1,T2) Rare Node b Semantic ✘

Loss

Optimization

T2

b

0.4

Phase:1

(T1,T3)

a

(T2,T3)

Rare Node Semantic ✓

Rare Node ✘

T1

T3

Attack Summary Graph

Backward Tracing

Phase:2

Phase:3

Forward Tracing

Semantic ✘

Attack Phase Identification

0.85 0.4

T3

b a

Predicted Edge

Edge Embedding

Weight

a

Core Nodes

Attack Windows Sequence

a a

Attack Chain Reconstruction

Figure 1. The architecture of TGL-APT

subject to |Hstruct (Graw ) − Hstruct (Gcomp )| ≤ ϵH ,

B. Provenance Graph Distillation Based on the information-bottleneck formulation in Section III-A, we first formalize the semantic role of the nodes that guide provenance graph distillation. Definition 1 (Information-Bottleneck Node). Given the provenance history G≤t and downstream security-relevant information Y , a node v is an information-bottleneck (IB) node at time t if its local provenance context Zt (v), consisting of its temporally valid dependencies and interaction history, satisfies three semantic properties. First, from an information-theoretic perspective, Zt (v) acts as an approximately minimal sufficient statistic for Y , preserving security-relevant information while suppressing redundant provenance context, i.e.,

(4)

and the preservation of temporally valid causal reachability among retained high-priority nodes. Here, Ω(Gcomp ) measures the size of the retained graph, and Hstruct denotes the structural entropy defined in the following subsection. Remark 1 (Connection to the IB Objective). Under the assumption that attack-relevant information is sparse and propagates along temporally valid provenance dependencies, C(v) and R(v) provide complementary surrogates for a node’s contribution to I(Gcomp ; Y ). A larger C(v) indicates stronger causal mediation, whereas a larger R(v) indicates less redundant and more behaviorally distinctive information. More specifically, we assume a monotonic relation in which, for nodes with comparable local context, stronger causal mediation or behavioral specificity does not decrease their marginal contribution to task-relevant information. Under this assumption, the score term in Eq. (3) serves as a monotonic ranking surrogate for preserving I(Gcomp ; Y ), rather than as a numerical lower bound or exact estimator of mutual information. Thus, graph-size reduction operationalizes the compression side of the IB objective, while the node-priority score operationalizes its task-relevance side; the structural and causal constraints further preserve the provenance context required for downstream analysis.

I(Y ; G≤t | Zt (v)) ≤ ϵ, while I(Zt (v); G≤t ) is kept small. Second, from a graphtopological perspective, v acts as a causal bridge whose removal may disrupt temporally valid causal reachability. Third, from a temporal perspective, the relevance of v may change as system behavior evolves, and its behavioral change may indicate a transition toward an attack-relevant state. Therefore, an IB node is characterized by information sufficiency, causal mediation, and temporal transition relevance rather than by structural importance alone. We construct Graw from audit records collected from Windows ETW, Linux Auditd, and other sources. The graph contains three types of system entities: processes, files, and network sockets. Directed edges represent system dependencies,

4

while T and A provide temporal and attribute information, respectively. The detailed entities, attributes, and dependency relationships are summarized in Table I.

a predefined threshold ϵH . Together, these constraints preserve the structural and causal context surrounding the selected information-bottleneck nodes. The node-priority score determines which entities are considered during knowledge screening, whereas the subsequent constraints determine whether their surrounding provenance context can be safely reduced. The resulting preservation and downstream stability properties are summarized in Lemma 1.

TABLE I S YSTEM E NTITIES , T HEIR ATTRIBUTES , AND D EPENDENCY R ELATIONSHIPS Source Node Target Node Process

Process File Socket

Relation

Entity Attribute

Start, Close, Clone Image pathname Read, Write, Open, Exec File pathname Send, Receive Src/Dst IP/port

Lemma 1 (Structural-Causal Preservation and Detection Stability). Let Gcomp be the graph produced by the two-stage distillation process. Let Preq denote the causal relations between retained nodes connected by at least one temporally valid path in Graw , and Ppres denote the subset whose causal reachability is preserved in Gcomp . Define

Since directly estimating the mutual-information conditions in Definition 1 is intractable for large dynamic provenance graphs, we operationalize IB-node identification using structural mediation and behavioral specificity as tractable surrogates. The distillation priority of node vi is defined as Score (vi ) = α · C(vi ) + β · R(vi ),

ρcausal =

α + β = 1, β > α, (5)

j=1 λj

,

Linfo = |Hstruct (Graw ) − Hstruct (Gcomp )| + κ(1 − ρcausal ). (9) If the structural entropy deviation is bounded by ϵH and causal reachability is preserved for every relation in Preq , then Linfo (Graw , Gcomp ) ≤ ϵH .

Hstruct (G) = −

pi log pi ,

(10)

Furthermore, let Ze (G) denote the temporal representation of a retained event e. If the temporal encoder is LΦ -Lipschitz with respect to Linfo and the reconstruction-error function is Lℓ -Lipschitz with respect to Ze , then |RE(e; Graw ) − RE(e; Gcomp )| ≤ Lℓ LΦ ϵH .

(11)

Proof. The causal-connectivity constraint implies Ppres = Preq and hence ρcausal = 1. Together with the structuralentropy constraint,

(6)

Linfo = |Hstruct (Graw ) − Hstruct (Gcomp )| ≤ ϵH .

and define the structural entropy as n X

(8)

where ρcausal = 1 when Preq = ∅, and

where C(vi ) measures structural importance by combining Betweenness Centrality and PageRank, and R(vi ) characterizes behavioral specificity using Inverse Interaction Frequency and interaction entropy. A larger weight is assigned to R(vi ) to reduce the bias of global centrality toward frequently active benign entities and to emphasize low-frequency, behaviorally distinctive interactions. The behavioral specificity term helps retain low-frequency and locally connected entities that may be overlooked by global centrality. Low-ranked intermediate nodes required for causal connectivity are further preserved during the subsequent pruning stage. To control structural distortion introduced by graph reduction, we use a spectral structural entropy derived from the normalized graph Laplacian. For a graph G, let λ1 , . . . , λn denote the eigenvalues of its normalized Laplacian matrix. We first normalize the spectrum as λi pi = Pn

|Ppres | , |Preq |

For a retained event e, the Lipschitz assumptions further give

(7)

|RE(e; Graw ) − RE(e; Gcomp )|

i=1

where pi log pi is defined as zero when pi = 0. Based on the node priorities, TGL-APT performs a twostage distillation process. In the knowledge screening stage, nodes are ranked according to Score (vi ), and the top-ranked nodes are retained as the candidate set. In the structure pruning stage, redundant nodes are removed subject to two constraints. First, the causal connectivity constraint preserves at least one temporally valid causal path between retained nodes that are causally connected in Graw ; low-ranked intermediate nodes are retained when required to maintain such paths. Second, the structural information constraint requires the structural entropy deviation between the raw and distilled graphs to remain below

≤ Lℓ ∥Ze (Graw ) − Ze (Gcomp )∥ ≤ Lℓ LΦ Linfo ≤ Lℓ LΦ ϵH . Thus, bounded structural-causal distortion induces a bounded perturbation in the reconstruction-error scores used for downstream anomaly detection. Lemma 1 shows that the proposed distillation not only bounds structural and causal information loss, but also limits its influence on downstream anomaly scores under the stated stability assumptions. The resulting distilled graph Gcomp = (Vcomp , Ecomp ) is then used for subsequent temporal graph learning.

5

the probability distribution P(et ) over the set of predefined interaction types for edge et :

C. Temporal Graph Learning with Adaptive Focus Mechanism The temporal graph learning module aims to construct a representation learning framework capable of simultaneously capturing the structural evolution and temporal dependencies of the provenance graph. This module adopts an encoderdecoder architecture, learning normal system behavior patterns using only benign training data while dynamically refining its analysis focus as observed system behavior evolves. As shown in Figure 1, when a new edge et appears in the compressed view Gcomp , the encoder generates an edge embedding Z based on the neighborhood state st− before the edge’s occurrence, and the decoder reconstructs the edge type probability distribution P(et ) from this embedding. The encoder and decoder are jointly trained exclusively on benign data, aiming to minimize the reconstruction error for benign edges. The core of the encoder is to construct an edge embedding that integrates spatiotemporal information. TGL-APT employs an enhanced Temporal Graph Network (TGN) architecture, incorporating a multi-head graph attention mechanism to focus on potentially anomalous interaction patterns while capturing the evolution of node historical states. For a new edge et = (vsrc , vdst ) occurring at time t, the computation of its embedding Zt depends not only on the historical states st− (vsrc ) and st− (vdst ) of the source and target nodes but also on the local neighborhood structure obtained through sampling. Unlike the base TGN, TGL-APT utilizes the set of core nodes H selected in Section III-B to guide neighborhood sampling, prioritizing connections to core nodes, thus more efficiently capturing critical paths that attacks might exploit. The encoding process is as follows:

P(et ) = MLPψ (Zt ).

During training, TGL-APT optimizes the model parameters θ, ϕ, ψ by minimizing the cross-entropy loss between the predicted distribution P(et ) and the one-hot encoding L(et ) of the true edge type: L = CrossEntropy(P(et ), L(et )).

st (vdst ) = GRUϕ (st− (vdst ), Zt ) .

(15)

The model thus learns what type of interaction is considered ”normal” within a given spatiotemporal context. During inference, the reconstruction error is this cross-entropy loss value, reflecting the deviation of the current event from the learned normal patterns. In long-running provenance streams, the relevance of information-bottleneck nodes may change as system behavior evolves. A core node set selected from the initial graph therefore cannot remain equally informative over time. To address this issue, TGL-APT continuously refines the core set using model-derived signals from temporal learning. Attention contribution reflects how strongly a node influences current neighborhood representations, while embedding deviation measures how far its current behavior departs from the benign prototype. Together, these signals allow the model to incorporate newly informative nodes and discard nodes whose contribution has diminished. Algorithm 1 Adaptive Focus Mechanism Require: Current core node set Hcurr , graph attention weights, node embedding vectors, benign embedding cluster centers, total number of nodes N Ensure: Updated core node set Hnew 1: Compute the average graph attention weight for all nodes over the past epoch 2: Sort in descending order by weight, take the top ηα nodes and α add to Hadd 3: Compute the Euclidean distance between all node embeddings and the benign prototype embedding cluster center 4: Sort in descending order by deviation, take the top ηδ nodes and δ add to Hadd 5: for v ∈ Hcurr do 6: Compute the average attention contribution Catt (v) for node v 7: end for 8: Sort by Catt (v) in ascending order, remove the bottom ηdrop nodes, the remaining nodes form Hkeep α δ 9: Hnew ← (Hadd ∪ Hadd ) ∪ Hkeep 10: Mmax ← γ · N 11: if |Hnew | > Mmax then 12: Compute the comprehensive score S(v) for each node in Hnew 13: Sort by S(v) in descending order, retain the top Mmax nodes 14: end if 15: return Hnew

Zt = GNNθ (st− (vsrc ), st− (vdst ), NH (vsrc ), NH (vdst ), e, t), (12) where NH (·) denotes biased neighborhood sampling based on the core node set H, e is the feature vector of edges within the neighborhood (formed by concatenating node feature hashes and edge types), and t is the timestamp vector of the corresponding edges. The GNN model employs a multihead attention mechanism for message passing, enabling the model to assign differentiated importance weights to different neighbor interactions, thereby highlighting anomalous or rare connection patterns. After a new edge et occurs, the states of the source node vsrc and target node vdst need to be updated accordingly. TGLAPT uses a Gated Recurrent Unit (GRU) to iteratively update the states of both endpoints, enabling them to retain memory of their historical interaction sequences: st (vsrc ) = GRUϕ (st− (vsrc ), Zt ) ,

(14)

(13)

The updated state st (·) is then used for subsequent edgeembedding computations. The decoder is an MLP whose task is to reconstruct, based on the edge embedding Zt output by the encoder,

The adaptive update follows a relevance-refinement process. Nodes with high attention contribution or large embedding deviation are treated as newly informative candidates, while low-contribution nodes are removed from the current core set.

6

The updated set is further constrained by a proportional size budget to prevent uncontrolled growth. In this way, adaptive focusing extends the initial graph distillation from a static selection to a dynamic information focus that follows changes in node relevance over time.

to highlight the contribution of key suspicious entities to the attack fingerprint. To reduce high-dimensional sparsity, contrastive learning is used to map TF-IDF weighted attack fingerprints into a low-dimensional embedding space. During training, windows sharing suspicious entities are treated as positive pairs, while temporally distant windows without shared entities are treated as negative pairs. Entity co-occurrence therefore serves as a weak supervisory signal for learning semantic representations of suspicious windows. The learned embeddings capture behavioral similarity between windows, allowing related suspicious activities to be associated even when they do not share the same entities. During inference, the semantic similarity between window embeddings is measured by cosine similarity. The final window association adopts a fusion rule that combines entity cooccurrence and semantic similarity: Ti and Tj are associated if Si ∩ Sj ̸= ∅ or Simsem (Ti , Tj ) > κ. This dual-channel association complements exact entity matching with fingerprint-level semantic similarity, allowing fragmented suspicious activities across different entities and time windows to be linked for subsequent attack investigation. Each queue Q maintains a dynamically updated anomaly score AnomalyScore(Q). This score is the product of the anomaly scores of all time windows in the queue, where the anomaly score for a single window T is defined as the average reconstruction error of all anomalous edges within that window. n Y AnomalyScore(Ti ). (16) AnomalyScore(Q) =

D. Anomaly Detection The anomaly detection module aims to identify coherent suspicious behavior sequences from continuous system activities. Its core design is cross-spatiotemporal attack fingerprint alignment, which addresses the synonymous but heterogeneous problem, where behaviorally related attack activities may appear across different entities and time windows without direct entity co-occurrence. TGL-APT therefore complements entity-based association with semantic similarity between suspicious time windows to recover such fragmented associations. This module operates at the time-window level, while attack stages are subsequently identified during attack investigation. TGL-APT divides the temporal graph into fixed-length time windows T . For each window, TGL-APT identifies a set of suspicious nodes ST . A node v is deemed suspicious if it simultaneously satisfies the following two conditions: (1) Anomaly: Node v must be the endpoint of at least one anomalous edge. Whether an edge e is anomalous depends on the reconstruction error RE(e) produced by the temporal graph learning module. TGL-APT dynamically determines a reconstruction error threshold σT from the reconstruction-error distribution of each time window. If RE(e) > σT , edge e is considered anomalous. (2) Rarity: The system entity represented by node v should be uncommon in normal system behavior. TGL-APT uses Inverse Document Frequency (IDF) to quantify the global rarity of a node. For a node v appearingin Nv  historical time N windows, its IDF value is: IDF(v) = ln Nv +1 , where N is the total number of windows. A higher IDF value indicates rarer nodes. A rarity threshold α is set; node v satisfies the rarity condition only if IDF(v) > α. A node meeting both the anomaly and rarity conditions is included in the current window’s suspicious node set ST . Entity co-occurrence provides a direct way to associate suspicious windows, but it may miss related activities when the involved entities change over time. To complement this signal, TGL-APT constructs an attack fingerprint for each suspicious time window and measures semantic similarity between window fingerprints. Each time window T is regarded as a semantic document, and the suspicious nodes ST are treated as its behavioral words. Unlike general semantic association over all system entities, the fingerprint is constructed only from suspicious activities and weighted according to their discriminative importance, focusing the association on attackrelevant behavioral evidence. Different from the simple bag-of-words model, TGL-APT uses a TF-IDF weighted mechanism to generate attack fingerprint vectors, where the term frequency TF(v, T ) is determined by the anomaly intensity of edges connected to node v, so as

i=1

TGL-APT presets a queue anomaly threshold β based on benign validation data. At runtime, when the anomaly score of a queue Q exceeds β, that queue is flagged as a malicious activity sequence, triggering an investigation alert. This sequence {T1 , T2 , ..., Tn } represents the detected unit of potentially malicious activity that is coherent in time and semantics. E. Attack Investigation The core task of attack chain reconstruction is to restore a coherent and concise attack path from the detected malicious activity sequence Q. TGL-APT employs a lightweight reconstruction strategy based on causal expansion of anomalous nodes, directly utilizing the suspicious nodes identified during the anomaly detection stage and their causal connections in the original provenance graph to rebuild the attack flow, avoiding the computational overhead and logical redundancy associated with complex community detection and subgraph fusion. First, from all time windows contained in the malicious activity sequence Q, all nodes marked as ”suspicious” are extracted to form the initial anomalous node set Vanomaly . For each node v in Vanomaly , a bidirectional causal exploration is performed in the original full provenance graph Graw . (1) Forward Causal Expansion: Search forward in time along causal edges (e.g., process creation, file read/write,

7

network connection) starting from v, within a reasonable time range ∆T , and add all reachable nodes to the set Vforward (v). (2) Backward Traceability Reconstruction: Search backward in time along dependency paths (e.g., parent process, file dependency) that can reach v within ∆T , and add all such nodes to the set Vbackward (v). The expanded nodes and edges are first merged into a preliminary candidate subgraph. To suppress irrelevant expansion, causal branches that neither connect suspicious seed nodes nor lie on a temporally valid causal path between them are removed. The remaining nodes and edges form Gcandidate . A timestamp-constrained path search is then performed on Gcandidate to extract the causal backbone C, while redundant side branches are excluded from the reconstructed attack chain. As shown in Figure 2, following

misclassifying processes performing similar tasks as different stage starts, the functional flow similarity between nodes ai and aj is computed: Sim(ai , aj ) =

|Fai ∩ Faj | . max(|Fai |, |Faj |)

(17)

If Sim(ai , aj ) ≥ θsim , the nodes are considered to carry similar functional flows, and the more pivotal node is retained, merging redundant candidates. Finally, nodes are sorted by their comprehensive pivotalness score, and the top Kmax nodes are selected as stage characterization nodes Pscn . The timestamps of these nodes in the attack chain are used as boundaries to partition the different attack stages Phases. This method effectively identifies key nodes that signify stage transitions, enabling automated phase categorization of complex APT attacks and assisting security analysts in better understanding attack tactic evolution and formulating response strategies. IV. E VALUATION To comprehensively evaluate the effectiveness, efficiency, and practicality of TGL-APT for APT detection and investigation, we conduct systematic experiments from multiple perspectives, including detection performance, comparison with existing methods, computational efficiency, hyperparameter sensitivity, and attack reconstruction capability. Specifically, this section aims to answer the following key research questions through experiments: (1) Can TGL-APT accurately detect attack behaviors in running systems? (2) How does TGLAPT compare with state-of-the-art techniques? (3) How efficient is TGL-APT in terms of training time, detection latency, and memory consumption? (4) How do hyperparameters affect the detection and runtime performance of TGL-APT? (5) Can TGL-APT accurately reconstruct attack behaviors from the original provenance graph? A prototype of TGL-APT was implemented in Python. scikit-learn was used for hierarchical feature hashing and PyG for TGL-APT’s graph learning framework. Finally, GraphViz was used to visualize the attack summary graphs for manual inspection. Experiments were conducted on a Linux workstation with 64GB RAM, an Intel Core Ultra 7 processor (3.9 GHz), and an NVIDIA RTX A5000 48GB GPU.

Figure 2. Four-stage division of APT attacks and their tactical dependencies

TAGAPT [32], we organize the MITRE ATT&CK tactics into four attack stages rather than directly adopting the Cyber Kill Chain. The stage boundaries are automatically determined by the timestamps of the identified Stage Characterization Nodes (SCNs). TGL-APT proposes an automated phase categorization method based on structural pivotalness and behavioral specificity, centered around identifying Stage Characterization Nodes (SCNs). SCNs are typically process nodes that play a dominant role within a stage, characterized by three features. Feature 1, Global Pivotalness: Act as key connection points across multiple functional flows within that stage. Feature 2, Local Connectivity: Possess high out-degree and in-degree, actively initiating or passively receiving various types of operations. Feature 3, Behavioral Specificity: Their behavior patterns (types of functional flows they participate in) are significantly distinct from other SCNs, representing different attack tactics. Based on this, TGL-APT designs the following automated phase categorization algorithm: TGL-APT derives temporally valid functional flows from the pruned candidate graph Gcandidate to form a set F . Each functional flow represents a causally connected sequence of activities corresponding to a candidate attack sub-goal. It then calculates the number of functional flows |Fai | carried by each process node ai in C and its local graph density, screening nodes that simultaneously satisfy high pivotalness and high connectivity to form a candidate set Pcan . To avoid

A. Experimental Setup a) Datasets and Data Splits.: This section evaluates TGL-APT on three public datasets from DARPA Engagement 3: Cadets, ClearScope, and Theia [36]. These datasets differ in granularity, log format, attack methods, and system environments, providing diverse settings for evaluating TGL-APT and comparing it with state-of-the-art APT detection methods. The DARPA E3 dataset was collected from enterprise networks during red-blue adversarial exercises in the DARPA Transparent Computing project [36]. It provides attack scenarios, tools, attack details, example attack graphs, and system logs. The attacks involve activities such as HTTP communication, privilege elevation, backdoor execution, and .dll or .so injection across different hosts and endpoints. We use the Cadets,

8

ClearScope, and Theia sub-datasets and extract the nodes and edges required for model training and anomaly detection. The datasets are divided chronologically into training, validation, and testing periods to preserve temporal order. Events are further divided into consecutive non-overlapping windows with a length and step size of 15 minutes. The detailed dataset splits and temporal window settings are summarized in Table II.

Table III D ETECTION P ERFORMANCE OF TGL-APT Dataset

TABLE II DATASET SPLITS AND TEMPORAL WINDOW SETTINGS . Dataset

Training Validation

Cadets Apr. 2–4 ClearScope Apr. 4–6 Theia Apr. 3–5

Apr. 5 Apr. 7 Apr. 9

Testing

Window

TP TN FP FN Precision Recall Accuracy

Cadets 11 328 ClearScope 5 113 8 217 Theia

1 1 1

0 0 1

0.9167 0.8333 0.8889

1.0000 1.0000 0.8889

0.9971 0.9916 0.9912

F1 0.9565 0.9091 0.8889

and ORTHRUS [12]. This experiment aims to answer research question (2), i.e., how TGL-APT performs compared with existing APT detection approaches. The experimental results are shown in Table IV. Overall, TGL-APT achieves strong detection performance across the three datasets, particularly in recall and F1-score.

Step

Apr. 6–7 15 min 15 min Apr. 10–11 15 min 15 min Apr. 10–12 15 min 15 min

b) Implementation Details.: TGL-APT is trained using the Adam optimizer with a learning rate of 5 × 10−5 and a temporal graph embedding dimension of 100. The model is trained for 50 epochs on Cadets and Theia and for 30 epochs on ClearScope. All trainable parameters are initialized using the default initialization schemes of their corresponding PyTorch layers. For anomaly detection, the reconstruction-error threshold is dynamically calculated for each temporal window as σT = µT + 0.6sT , where µT and sT denote the mean and standard deviation, respectively, of the reconstruction errors of all edges within the current window. An edge is identified as anomalous when its reconstruction error exceeds σT . The functional-flow similarity threshold θsim is empirically set to 0.54.

Table IV C OMPARISON R ESULTS OF TGL-APT WITH OTHER M ETHODS Dataset

Method

Precision Recall Accuracy

F1

FPR

Cadets

KAIROS TFLAG ORTHRUS TGL-APT

0.8750 0.8889 0.0005 0.9167

0.6364 0.7273 0.0769 1.0000

0.9853 0.9882 0.9897 0.9971

0.7368 0.8000 0.0010 0.9565

0.0030 0.0030 0.0101 0.0030

ClearScope

KAIROS TFLAG ORTHRUS TGL-APT

0.7143 1.0000 0.7500 0.8333

1.0000 0.8000 0.6000 1.0000

0.9832 0.9946 0.9748 0.9916

0.8333 0.8889 0.6667 0.9091

0.0175 0.0000 0.0088 0.0088

Theia

KAIROS TFLAG ORTHRUS TGL-APT

0.8182 0.7143 0.0000 0.8889

1.0000 0.7143 0.0000 0.8889

0.9912 0.9680 0.9604 0.9912

0.9000 0.7143 0.0000 0.8889

0.0092 0.0169 0.0000 0.0046

B. Detection Performance To evaluate the fundamental anomaly detection capability of the TGL-APT framework, detection performance experiments were first conducted on three public datasets. This experiment aims to answer research question (1), i.e., whether TGL-APT can accurately identify attack behaviors from system operation logs. The widely recognized confusion matrix metrics were employed for evaluation, including True Positives (TP), True Negatives (TN), False Positives (FP), and False Negatives (FN). Based on these, Precision, Recall, Accuracy, and F1Score were calculated to comprehensively measure the model’s overall performance under imbalanced positive and negative samples. The experimental results are shown in Table III. On the three real-world DARPA E3 datasets, TGL-APT maintained a high recall rate, meaning nearly all attack events were successfully captured. The precision was slightly lower, at 0.9167, 0.8333, and 0.8889 on the three datasets respectively, due to a very small number of false positives. Nevertheless, TGL-APT maintained strong F1-scores across all datasets, demonstrating a favorable balance between precision and recall while keeping the false positive rate low.

On Cadets, TGL-APT achieved the highest recall and F1score while maintaining high precision and a low false positive rate. Compared with KAIROS and TFLAG, its F1-score increased by approximately 21.9 and 15.7 percentage points, respectively. On ClearScope, TGL-APT achieved a recall of 1.0000 and the highest F1-score of 0.9091, providing a better balance between precision and recall. On Theia, TGL-APT achieved the highest precision and remained competitive in F1-score. ORTHRUS yields very few positive detections on Cadets and none on Theia, resulting in low recall and F1 despite high accuracy; this may partly reflect the difference between its attribution-oriented design [12] and the detection-focused evaluation used here. Overall, TGL-APT demonstrates strong detection performance across the three datasets, particularly in recall and F1score, while maintaining a low false positive rate. These results indicate that TGL-APT can effectively capture diverse APT attack behaviors across different system environments.

C. Comparison Experiment To further evaluate the detection performance of TGLAPT, we compare it with three representative provenancebased APT detection methods, KAIROS [5], TFLAG [29],

To evaluate the feasibility and runtime efficiency of TGLAPT in practical deployment, we compare it with KAIROS and ORTHRUS in terms of training time, detection latency, and memory consumption. This experiment aims to answer

D. Efficiency Analysis

9



3HDN0HPRU\8VDJH*%

research question (3), i.e., how TGL-APT performs in computational efficiency while maintaining high detection accuracy. The efficiency evaluation considers training time, median and maximum per-window detection runtime, and peak memory usage on the three datasets. The results are reported in Table V. Table V E FFICIENCY C OMPARISON OF TGL-APT WITH OTHER M ETHODS Dataset

Method

Training Time (min)

Median Runtime (s)

Max Runtime (s)

Memory Usage (GB)

Cadets

KAIROS ORTHRUS TGL-APT

44.8 5.903 27.3

2.5 777.24 1.6

19.7 777.24 10.6

8.2 3.8400 6.4

ClearScope

KAIROS ORTHRUS TGL-APT

12.6 0.569 7.8

1.8 19.72 1.2

14.2 19.72 6.7

5.4 0.3600 4.1

Theia

KAIROS ORTHRUS TGL-APT

24.2 2.099 14.6

3.2 426.98 2.0

25.4 426.98 14.5

6.7 11.1611 5.2

7*/$37&DGHWV 7*/$37&OHDU6FRSH 7*/$377KHLD



.$,526&DGHWV .$,526&OHDU6FRSH .$,5267KHLD

      







7LPH:LQGRZ6L]HPLQ





Figure 3. Peak memory usage with respect to time window scale

(1) Node Embedding Dimension. The node embedding dimension affects the semantic representation of system entities. As shown in Figure 4a, performance remains high in a lowdimensional range but degrades gradually when |Φ| exceeds 64. A moderate dimension is sufficient for effective encoding, while an overlarge dimension introduces sparsity and extra overhead. (2) Neighborhood Sampling Size. The neighborhood sampling size governs the range of local structural information. The performance is poor at |N | = 5, improves significantly at |N | = 20, and then saturates. An excessively small size leads to insufficient structural modeling, while an overlarge size brings redundant information without performance gains. (3) Edge Embedding Dimension. The edge embedding dimension fuses temporal and structural information. As shown in Figure 4c, the performance increases with dimension and peaks at 200. Excessively high dimensions lead to overfitting and higher computation costs, resulting in performance degradation. (4) Time Window Length. The time window length controls the temporal granularity. As shown in Figure 4d, an overly short window fails to capture temporal context, while an overly long window introduces excessive benign interference and reduces recall ( |tw| = 60). The moderate length |tw| = 15 achieves the best balance.

Thanks to the compressed view construction module, which significantly reduces the size of the original provenance graph, TGL-APT achieved an average reduction in training time of approximately 39% across the three datasets compared to KAIROS. This is mainly because the compressed view filters redundant entities and edges, reducing the amount of graph information processed during temporal learning. The typical detection latency (median time) of TGL-APT was on average about 33% lower than that of KAIROS, and its maximum per-window detection time was also consistently lower, indicating better response efficiency during routine and high-load detection. The peak memory usage was reduced by approximately 22% compared to KAIROS, which is consistent with the smaller graph representation maintained during runtime. Although ORTHRUS requires substantially less training time, low online detection latency is particularly important for continuous APT monitoring. TGL-APT therefore trades higher offline training cost for substantially lower detection runtime and stronger detection performance. To further evaluate the impact of time window scale on memory consumption, we compare TGL-APT with KAIROS using window sizes from 5 to 30 minutes, as shown in Figure 3. As the time window expands, TGL-APT exhibits more gradual memory growth, whereas KAIROS shows a more pronounced increase under full-graph modeling. These results indicate that TGL-APT scales more favorably with increasing time window size.

F. Ablation Study To evaluate the contribution of the key components in TGL-APT, we conduct ablation experiments by removing information-bottleneck graph distillation (w/o IB Distillation), dynamic core node update (w/o DU, Algorithm 1), TF-IDF weighting (w/o TF-IDF), and contrastive learning (w/o Contrastive). These ablations evaluate the effects of provenance distillation, adaptive relevance refinement, and cross-window semantic correlation on detection performance. The effect of information-bottleneck graph distillation is evaluated on the CADETS dataset. For w/o IB Distillation, core-node filtering and updating are disabled, and temporal learning is performed on all edges of the preprocessed temporal graph. As shown in Table VI, removing the distillation

E. Hyperparameter Analysis We conduct ablation experiments on four key hyperparameters, including node embedding dimension |Φ|, neighborhood sampling size |N |, edge embedding dimension |z|, and time window length |tw|, on the Cadets dataset to analyze their impacts on detection performance.

10









7*/$37 7*/$37ZR'8





  

3UHFLVLRQ 5HFDOO $FFXUDF\ ) 





















5DWH

5DWH



 























(c) |z|







(d) |tw|

TABLE VI A BLATION R ESULTS OF I NFORMATION -B OTTLENECK G RAPH D ISTILLATION ON CADETS TP TN FP FN Precision Recall Accuracy 0 7

0.9167 0.8000

7KHLD



&DGHWV

&OHDU6FRSH

7KHLD

(b) TF-IDF and Contrastive Learning

direct overlap of anomalous nodes; entity co-occurrence alone is therefore insufficient to associate fragmented suspicious activities. On ClearScope, although w/o TF-IDF maintained a recall of 1.000, its precision was lower, suggesting that entity co-occurrence introduced a significant number of false associations by incorrectly linking unrelated windows. On the Theia dataset, the performance of w/o TF-IDF was comparable to the full model, presumably because suspicious activities in this dataset exhibited stronger entity co-occurrence, making co-occurrence itself sufficient for window correlation. After retaining TF-IDF weighting but removing contrastive learning (w/o Contrastive), the model’s F1-score dropped by 8.6% and 4.4% on Cadets and ClearScope, respectively, and by 3.5% on Theia. This shows that although TF-IDF provides semantic vector representations for suspicious windows, directly computing cosine similarity in the high-dimensional sparse space is less effective for capturing semantic relationships between them. Contrastive learning improves the semantic representation of suspicious windows in a low-dimensional embedding space, showing greater benefits in scenarios with diverse behavioral patterns and frequent entity changes.

Figure 4. Impact of different hyperparameters on TGL-APT performance

TGL-APT 11 328 1 w/o IB Distillation 4 328 1

&OHDU6FRSH

Figure 5. Ablation study results of key modules







&DGHWV

(a) Dynamic Core Node Update



Variant





(b) |N |













(a) |Φ|



ZR7),') ZR&RQWUDVWLYH 7*/$37





)6FRUH

 )6FRUH

 5DWH

5DWH



1.0000 0.3636

0.9971 0.9765

F1 0.9565 0.5000

module causes the F1-score to decrease from 0.9565 to 0.5000, while recall drops from 1.0000 to 0.3636. In particular, the number of true positives decreases from 11 to 4 and false negatives increase from 0 to 7, whereas the number of false positives remains unchanged. This result suggests that directly learning from the undistilled provenance graph makes sparse attack-related activities more difficult to distinguish from large volumes of routine system behavior. By prioritizing structurally and behaviorally informative entities while preserving their causal context, graph distillation helps retain attackrelevant evidence for subsequent temporal learning. The dynamic core node update is evaluated across all three datasets. As shown in Figure 5a, removing this mechanism (TGL-APT w/o DU) reduces the F1-score by an average of about 4.5%. Precision decreases noticeably, while recall also declines slightly on Cadets. This indicates that keeping the initially selected core node set fixed becomes less effective as system behavior evolves. The dynamic update incorporates nodes with high attention weights and large embedding deviations while removing low-contribution nodes, allowing the model to maintain its focus on informative entities over time. Figure 5b shows the comparison results of different correlation strategies. The strategy based solely on entity cooccurrence (w/o TF-IDF) resulted in a sharp drop in recall on the Cadets dataset to 0.64, with the F1-score reduced by 22.0% compared to the full model. This indicates that related suspicious activities in this scenario frequently involve different entities across time windows, resulting in limited

G. Attack Investigation Evaluation To evaluate the stage categorization component of attack investigation, we conduct a quantitative evaluation on the DARPA E3 dataset. Following the four-stage organization described in Section III, the reconstructed attack chain is divided into four stages. Using manually annotated stage labels as ground truth, we compare the stage assignment of each system event (edge) with the algorithm output and report Precision, Recall, and F1-score for each stage, as shown in Figure 6. The following case study further illustrates the reconstructed attack chain and its stage organization. As seen in Figure 6, the phase categorization algorithm achieved high F1-scores across all four stages, with Stage 4 achieving the highest F1-score, with Precision and Recall reaching 94.79% and 97.28%, respectively. This indicates that the attacker’s behavior during the final objective achievement and trace cleanup stage is relatively concentrated and featurerich, allowing the algorithm to identify it accurately. Stage 2 had a relatively lower F1-score, mainly due to a slightly lower recall. Analysis suggests that this stage contains diverse tactical behaviors such as persistence, privilege escalation, and information gathering, which are often mixed with normal

11

information relevance, causal mediation, and temporal behavioral change rather than specific entities or attack patterns, the abstraction also supports generalization across heterogeneous attacks. Limitations and future work. Attack-chain reconstruction is currently evaluated through stage-level metrics and case studies, while the adaptive focus mechanism uses a fixed update schedule. Future work will quantitatively evaluate causal-path reconstruction against ground-truth attack graphs and explore adaptive online updates, weakly supervised IB refinement, and structured investigation reports.

 

3UHFLVLRQ 5HFDOO )VFRUH

3HUFHQWDJH

     

6WDJH

6WDJH

6WDJH

6WDJH

Figure 6. Evaluation results of attack investigation phase categorization

R EFERENCES [1] M. Zipperle, F. Gottwalt, E. Chang, and T. Dillon, “Provenance-based intrusion detection systems: A survey,” ACM Comput. Surv., vol. 55, no. 7, Dec. 2022. [2] Z. Li, Q. A. Chen, R. Yang, Y. Chen, and W. Ruan, “Threat detection and investigation with system-level provenance graphs: A survey,” Computers & Security, vol. 106, p. 102282, 2021. [3] Z. Jia, Y. Xiong, Y. Nan, Y. Zhang, J. Zhao, and M. Wen, “MAGIC: Detecting advanced persistent threats via masked graph representation learning,” in 33rd USENIX Security Symposium (USENIX Security 24). Philadelphia, PA: USENIX Association, Aug. 2024, pp. 5197–5214. [4] M. U. Rehman, H. Ahmadi, and W. U. Hassan, “Flash: A comprehensive approach to intrusion detection via provenance graph representation learning,” in 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024, pp. 3552–3570. [5] Z. Cheng, Q. Lv, J. Liang, Y. Wang, D. Sun, T. Pasquier, and X. Han, “Kairos: Practical intrusion detection and investigation using wholesystem provenance,” in 2024 IEEE Symposium on Security and Privacy (SP), 2024, pp. 3533–3551. [6] X. Li, X. Jiang, H. Wan, and X. Zhao, “Tered: Normal behavior-based efficient provenance graph reduction for large-scale attack forensics,” IEEE Transactions on Information Forensics and Security, vol. 20, pp. 9463–9476, 2025. [7] A. Lv, G. Ouyang, and Y. Huang, “Vgae4pg: A semantically preserved unsupervised provenance graph reduction framework,” in 2026 29th International Conference on Computer Supported Cooperative Work in Design (CSCWD), 2026, pp. 947–956. [8] B. Zhang, Y. Gao, C. Yu, B. Kuang, Z. Zhang, H. Kim, and A. Fu, “TAPAS: An efficient online APT detection with task-guided process provenance graph segmentation and analysis,” in 34th USENIX Security Symposium (USENIX Security 25). USENIX Association, 2025, pp. 607–624. [9] Z. Wang, H. Li, Y. Qi, W. Qiao, S. Liu, C. Zhang, B. Jiang, and Z. Lu, “Pathwatcher: A path-based behavior detection method for attack detection and investigation,” Computers & Security, vol. 157, p. 104563, 2025. [10] A. Goyal, G. Wang, and A. Bates, “R-caid: Embedding root cause analysis within provenance-based intrusion detection,” in 2024 IEEE Symposium on Security and Privacy (SP), 2024, pp. 3515–3532. [11] F. Dong, S. Li, P. Jiang, D. Li, H. Wang, L. Huang, X. Xiao, J. Chen, X. Luo, Y. Guo, and X. Chen, “Are we there yet? an industrial viewpoint on provenance-based endpoint detection and response tools,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’23. New York, NY, USA: Association for Computing Machinery, 2023, pp. 2396–2410. [12] B. Jiang, T. Bilot, N. El Madhoun, K. Al Agha, A. Zouaoui, S. Iqbal, X. Han, and T. Pasquier, “{ORTHRUS}: Achieving high quality of attribution in provenance-based intrusion detection systems,” in 34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 7173– 7192. [13] M. Tatam, B. Shanmugam, S. Azam, and K. Kannoorpatti, “A review of threat modelling approaches for apt-style attacks,” Heliyon, vol. 7, no. 1, p. e05969, 2021. [14] A. Alageel and S. Maffeis, “Investigation of advanced persistent threats network-based tactics, techniques and procedures,” Computer Networks, vol. 278, p. 112069, 2026.

system operations, increasing the difficulty of categorization. Nevertheless, its F1-score remained above 87%, showing that the SCN-based categorization can distinguish the four attack stages under relatively complex behavioral patterns. To complement the quantitative stage-level evaluation, Figure 7 presents a qualitative investigation case study on the Cadets dataset, illustrating the reconstructed causal backbone and its subsequent stage categorization. As shown, four stage characterization nodes divide the attack behavior into four stages, namely Stage 1 Initial Intrusion, Stage 2 Residence and Exploration, Stage 3 Lateral Movement, and Stage 4 Objective Achievement and Cover-up. From the IB perspective, these nodes are important not merely because of their local connectivity, but because they mediate transitions between causally distinct attack behaviors. The execution of /etc/vUgefal exhibits high behavioral specificity R(v) because this rare interaction deviates from repetitive benign activities and marks the transition toward persistent malicious behavior. In contrast, the elevated sshd process exhibits strong structural mediation C(v) by bridging local host compromise with multiple external network interactions. These roles are consistent with the causal-bridging and temporal-transition semantics of IB nodes, explaining why these SCNs become representative boundaries between attack stages. Ultimately, the attack triggered a kernel crash to achieve destructive objectives, accompanied by coverup actions such as log tampering and file deletion. This case study illustrates how TGL-APT organizes reconstructed suspicious activities into an interpretable attack process, providing analysts with a concise view of attack evolution. V. C ONCLUSION This paper presents TGL-APT, an efficient and adaptive framework for provenance-based APT detection and investigation. TGL-APT combines information-bottleneckguided graph distillation, adaptive temporal learning, crossspatiotemporal fingerprint alignment, and causal reconstruction to reduce provenance redundancy and organize fragmented suspicious activities into interpretable attack processes. Experiments on the DARPA E3 datasets demonstrate favorable detection accuracy, computational efficiency, and stage-level investigation capability. Since IB nodes are characterized by

12

/etc/group

exec read 81.49.200.166

Nginx

connect

sshd(PID 8000)

/etc/password

write delete

connect

root

exec

inject vUgefal(PID 7)

78.205.235.65

200.16.109.214

write chmod

/usr/log/dev

netrecon tcp

pc 21

Stage 2

kernel panic

connect

/etc/vUgefal

Stage 1 Stage 3 Stage 4

read

/dev/gia_alia

crash

139.123.0.113

154.143.113.18

61.167.39.128

Figure 7. Example of attack investigation phase categorization on Cadets dataset

[15] S. M. Milajerdi, R. Gjomemo, B. Eshete, R. Sekar, and V. Venkatakrishnan, “Holmes: real-time apt detection through correlation of suspicious information flows,” in 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 1137–1152. [16] S. M. Milajerdi, B. Eshete, R. Gjomemo, and V. Venkatakrishnan, “Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting,” in Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, 2019, pp. 1795–1812. [17] M. N. Hossain, S. M. Milajerdi, J. Wang, B. Eshete, R. Gjomemo, R. Sekar, S. Stoller, and V. Venkatakrishnan, “SLEUTH: Real-time attack scenario reconstruction from COTS audit data,” in 26th USENIX Security Symposium (USENIX Security 17). Vancouver, BC: USENIX Association, Aug. 2017, pp. 487–504. [18] Q. Wang, W. U. Hassan, D. Li, K. Jee, X. Yu, K. Zou, J. Rhee, Z. Chen, W. Cheng, C. A. Gunter et al., “You are what you do: Hunting stealthy malware via data provenance analysis.” in NDSS, 2020. [19] Y. Fang, C. Wang, Z. Fang, and C. Huang, “Lmtracker: Lateral movement path detection based on heterogeneous graph embedding,” Neurocomputing, vol. 474, pp. 37–47, 2022. [20] T. Chen, C. Dong, M. Lv, Q. Song, H. Liu, T. Zhu, K. Xu, L. Chen, S. Ji, and Y. Fan, “Apt-kgl: An intelligent apt detection system based on threat knowledge and heterogeneous provenance graph learning,” IEEE Transactions on Dependable and Secure Computing, pp. 1–15, 2022. [21] MITRE, “MITRE ATT&CK Framework,” 2022. [Online]. Available: https://attack.mitre.org [22] N. Xiao, B. Lang, T. Wang, and Y. Chen, “Apt-mmf: An advanced persistent threat actor attribution method based on multimodal and multilevel feature fusion,” Computers & security, vol. 144, p. 103960, 2024. [23] E. Manzoor, S. M. Milajerdi, and L. Akoglu, “Fast memory-efficient anomaly detection in streaming heterogeneous graphs,” in Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, 2016, pp. 1035–1044. [24] X. Han, T. Pasquier, A. Bates, J. Mickens, and M. Seltzer, “Unicorn: Runtime provenance-based detector for advanced persistent threats,” in 27th Annual Network and Distributed System Security Symposium (NDSS 2020). The Internet Society, 2020. [25] S. Wang, Z. Wang, T. Zhou, H. Sun, X. Yin, D. Han, H. Zhang, X. Shi, and J. Yang, “Threatrace: Detecting and tracing host-based threats in node level through provenance graph learning,” IEEE Transactions on Information Forensics and Security, vol. 17, pp. 3972–3987, 2022. [26] F. Demirkıran, A. Çayır, U. Ünal, and H. Dağ, “An ensemble of pretrained transformer models for imbalanced multiclass malware classification,” Computers & Security, vol. 121, p. 102846, 2022. [27] A. Çayır, U. Ünal, and H. Dağ, “Random capsnet forest model for imbalanced malware type classification task,” Computers & Security, vol. 102, p. 102133, 2021. [28] W. Hamilton, Z. Ying, and J. Leskovec, “Inductive representation

learning on large graphs,” Advances in neural information processing systems, vol. 30, 2017. [29] W. Jiang, T. Chai, H. Liu, K. Wang, and H. Zhang, “Tflag: Towards practical apt detection via deviation-aware learning on temporal provenance graph,” arXiv preprint arXiv:2501.06997, 2025. [30] J. Li, R. Zhang, and J. Liu, “Provgrp: a context-aware provenance graph reduction and partition approach for facilitating attack investigation,” Electronics, vol. 13, no. 1, p. 100, 2023. [31] T. Zhu, J. Yu, C. Xiong, W. Cheng, Q. Yuan, J. Ying, T. Chen, J. Zhang, M. Lv, Y. Chen et al., “Aptshield: A stable, efficient and real-time apt detection system for linux hosts,” IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 6, pp. 5247–5264, 2023. [32] W. Cheng, Q. Yuan, T. Zhu, T. Chen, J. Ying, A. Zheng, M. Ma, C. Xiong, M. Lv, and Y. Chen, “Tagapt: Toward automatic generation of apt samples with provenance-level granularity,” IEEE Transactions on Information Forensics and Security, vol. 20, pp. 4137–4151, 2025. [33] V. D. Blondel, J.-L. Guillaume, R. Lambiotte, and E. Lefebvre, “Fast unfolding of communities in large networks,” Journal of statistical mechanics: theory and experiment, vol. 2008, no. 10, p. P10008, 2008. [34] W. Qiao, Y. Feng, T. Li, Z. Ma, Y. Shen, J. Ma, and Y. Liu, “Slot: Provenance-driven apt detection through graph reinforcement learning,” in Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, 2025, pp. 963–977. [35] N. Tishby, F. C. Pereira, and W. Bialek, “The information bottleneck method,” arXiv preprint physics/0004057, 2000. [36] DARPA and I2O, “Transparent computing engagement 3 data release,” https://github.com/darpa-i2o/TransparentComputing/blob/master/README-E3.md, 2018.

13

Related documents

• post-graph-rag: A PostgreSQL-Native Bi-Temporal Graph RAG Engine with Temporal Grounding at Synthesis#973343
• Embedded graph convolutional networks for real-time event data processing on SoC FPGAs#254325
• RL Starts before RL: On Policy Distillation for Better Reinforcement Learning#1064689
• Flow Matching Reinforcement for 3D Mesh Generation via Dynamic Homing Optimization#1156505
• TripleBound: Triplet-Guided Heterogeneous Graph Learning for Microservice Decomposition#998760