Advance Persistent Threats (APTs), adopted by most delicate attackers, are
becoming increasing common and pose great threat to various enterprises and
institutions. Data provenance analysis on provenance graphs has emerged as a
common approach in APT detection. However, previous works have exhibited
several shortcomings: (1) requiring attack-containing data and a priori
knowledge of APTs, (2) failing in extracting the rich contextual information
buried within provenance graphs and (3) becoming impracticable due to their
prohibitive computation overhead and memory consumption.
In this paper, we introduce MAGIC, a novel and flexible self-supervised APT
detection approach capable of performing multi-granularity detection under
different level of supervision. MAGIC leverages masked graph representation
learning to model benign system entities and behaviors, performing efficient
deep feature extraction and structure abstraction on provenance graphs. By
ferreting out anomalous system behaviors via outlier detection methods, MAGIC
is able to perform both system entity level and batched log level APT
detection. MAGIC is specially designed to handle concept drift with a model
adaption mechanism and successfully applies to universal conditions and
detection scenarios. We evaluate MAGIC on three widely-used datasets, including
both real-world and simulated attacks. Evaluation results indicate that MAGIC
achieves promising detection results in all scenarios and shows enormous
advantage over state-of-the-art APT detection approaches in performance
overhead.

MAGIC 是一种新颖灵活的自我监督 APT 检测方法，能够在不同级别的监督下执行多颗粒度检测，通过掩码图表示学习对良性系统实体和行为进行建模，在溯源图上进行高效深度特征提取和结构抽象，通过异常检测方法检测异常系统行为，从而实现系统实体级别和批量日志级 APT 检测，解决了概念漂移问题，并成功应用于广泛的条件和检测场景。在三个广泛使用的数据集上对 MAGIC 进行评估，包括真实世界和模拟攻击。评估结果表明，MAGIC 在所有场景中都取得了有希望的检测结果，并在性能开销上比现有的 APT 检测方法具有巨大优势。

通过掩盖图表表示学习检测高级持久性威胁

MAGIC: Detecting Advanced Persistent Threats via Masked Graph  Representation Learning

Advanced Persistent Threats (APTs) are difficult to detect due to their
"low-and-slow" attack patterns and frequent use of zero-day exploits. We
present UNICORN, an anomaly-based APT detector that effectively leverages data
provenance analysis. From modeling to detection, UNICORN tailors its design
specifically for the unique characteristics of APTs. Through extensive yet
time-efficient graph analysis, UNICORN explores provenance graphs that provide
rich contextual and historical information to identify stealthy anomalous
activities without pre-defined attack signatures. Using a graph sketching
technique, it summarizes long-running system execution with space efficiency to
combat slow-acting attacks that take place over a long time span. UNICORN
further improves its detection capability using a novel modeling approach to
understand long-term behavior as the system evolves. Our evaluation shows that
UNICORN outperforms an existing state-of-the-art APT detection system and
detects real-life APT scenarios with high accuracy.

通过数据来源分析，UNICORN 应用异常检测方法有效地检测高级持续性威胁（APTs），同时将其建模并利用图形分析技术，以寻找潜在的异常行为，并通过图形草图技术来压缩系统执行，以提高检测效率和准确度。