标题： GraphDART：用于高效高级持续性威胁检测的图蒸馏 显示英文标题

标题： GraphDART: Graph Distillation for Efficient Advanced Persistent Threat Detection

摘要： 网络物理社会系统（CPSSs）在近年来的许多应用中出现，需要更加关注安全问题。 像高级持续性威胁（APTs）这样的复杂威胁的兴起，使得确保CPSSs的安全尤其具有挑战性。 溯源图分析已被证明在追踪和检测系统内的异常方面是有效的，但这些图的规模和复杂性阻碍了现有方法的效率，尤其是那些依赖图神经网络（GNNs）的方法。 为了解决这些挑战，我们提出了GraphDART，一个模块化框架，旨在将溯源图提炼成紧凑而有信息量的表示，从而实现可扩展且有效的异常检测。 GraphDART可以利用多种图蒸馏技术，包括经典和现代的图蒸馏方法，在保留关键结构和上下文信息的同时压缩大型溯源图。 这种方法显著减少了计算开销，使GNN能够高效地从蒸馏后的图中学习并提高检测性能。 在基准数据集上的广泛评估表明，GraphDART在检测网络物理社会系统中的恶意活动方面具有鲁棒性。 通过优化计算效率，GraphDART提供了一种可扩展且实用的解决方案，以保护互联环境免受APT的威胁。 显示英文摘要

摘要： Cyber-physical-social systems (CPSSs) have emerged in many applications over recent decades, requiring increased attention to security concerns. The rise of sophisticated threats like Advanced Persistent Threats (APTs) makes ensuring security in CPSSs particularly challenging. Provenance graph analysis has proven effective for tracing and detecting anomalies within systems, but the sheer size and complexity of these graphs hinder the efficiency of existing methods, especially those relying on graph neural networks (GNNs). To address these challenges, we present GraphDART, a modular framework designed to distill provenance graphs into compact yet informative representations, enabling scalable and effective anomaly detection. GraphDART can take advantage of diverse graph distillation techniques, including classic and modern graph distillation methods, to condense large provenance graphs while preserving essential structural and contextual information. This approach significantly reduces computational overhead, allowing GNNs to learn from distilled graphs efficiently and enhance detection performance. Extensive evaluations on benchmark datasets demonstrate the robustness of GraphDART in detecting malicious activities across cyber-physical-social systems. By optimizing computational efficiency, GraphDART provides a scalable and practical solution to safeguard interconnected environments against APTs.