融合溯源图与知识图谱的APT攻击检测模型研究OA

Advanced Persistent Threat(APT)attacks,characterized by strong concealment,long duration,and multistage progressive pat-terns,were addressed by a novel detection model.The model was constructed through the fusion of dynamic system behavior provenance graphs with static threat intelligence knowledge graphs.Spatial dependencies and temporal evolution relationships within attack chains were jointly modeled using spatial-temporal graph attention networks.Suspicious associations between entities were captured through graph attention mecha-nisms,while stage-wise evolution of behavioral sequences was modeled using gated recurrent units,enabling end-to-end detection of complete APT attack chains.Experiments on the public Windows-APTs Dataset 2025 demonstrated that the proposed model performed well in the APT multi-classification detection task,with an accuracy of 95.14%and an F1-score of 95.29%.