标题： 连续体：通过空间-时间图神经网络检测APT攻击 显示英文标题

标题： CONTINUUM: Detecting APT Attacks through Spatial-Temporal Graph Neural Networks

摘要： 高级持续性威胁（APTs）由于其复杂和隐蔽的性质，在网络安全中构成了重大挑战。传统的入侵检测系统（IDS）在检测这些多阶段攻击时往往效果不佳。最近，图神经网络（GNNs）被用于增强IDS的能力，通过分析网络数据中的复杂关系。然而，现有的基于GNN的解决方案受到高误报率和大量资源消耗的限制。在本文中，我们提出了一种新的IDS，旨在使用时空图神经网络自动编码器检测APTs。我们的方法利用空间信息来理解图中实体之间的交互，并利用时间信息来捕捉图随时间的变化。这种双重视角对于识别APTs的顺序阶段至关重要。此外，为了解决隐私和可扩展性问题，我们将架构部署在联邦学习环境中。这种设置确保本地数据保留在本地，同时使用同态加密共享和聚合加密的模型权重，从而保持数据隐私和安全。我们的评估表明，与现有方法相比，该系统能够更有效地检测APTs，误报率更低，资源使用更优化，突显了时空分析和联邦学习在增强网络安全防御方面的潜力。 显示英文摘要

摘要： Advanced Persistent Threats (APTs) represent a significant challenge in cybersecurity due to their sophisticated and stealthy nature. Traditional Intrusion Detection Systems (IDS) often fall short in detecting these multi-stage attacks. Recently, Graph Neural Networks (GNNs) have been employed to enhance IDS capabilities by analyzing the complex relationships within networked data. However, existing GNN-based solutions are hampered by high false positive rates and substantial resource consumption. In this paper, we present a novel IDS designed to detect APTs using a Spatio-Temporal Graph Neural Network Autoencoder. Our approach leverages spatial information to understand the interactions between entities within a graph and temporal information to capture the evolution of the graph over time. This dual perspective is crucial for identifying the sequential stages of APTs. Furthermore, to address privacy and scalability concerns, we deploy our architecture in a federated learning environment. This setup ensures that local data remains on-premise while encrypted model-weights are shared and aggregated using homomorphic encryption, maintaining data privacy and security. Our evaluation shows that this system effectively detects APTs with lower false positive rates and optimized resource usage compared to existing methods, highlighting the potential of spatio-temporal analysis and federated learning in enhancing cybersecurity defenses.