APT detection is difficult to detect due to the long-term latency, covert and
slow multistage attack patterns of Advanced Persistent Threat (APT). To tackle
these issues, we propose TBDetector, a transformer-based advanced persistent
threat detection method for APT attack detection. Considering that provenance
graphs provide rich historical information and have the powerful attacks
historic correlation ability to identify anomalous activities, TBDetector
employs provenance analysis for APT detection, which summarizes long-running
system execution with space efficiency and utilizes transformer with
self-attention based encoder-decoder to extract long-term contextual features
of system states to detect slow-acting attacks. Furthermore, we further
introduce anomaly scores to investigate the anomaly of different system states,
where each state is calculated with an anomaly score corresponding to its
similarity score and isolation score. To evaluate the effectiveness of the
proposed method, we have conducted experiments on five public datasets, i.e.,
streamspot, cadets, shellshock, clearscope, and wget_baseline. Experimental
results and comparisons with state-of-the-art methods have exhibited better
performance of our proposed method.

TBDetector is a transformer-based APT detection method that uses provenance analysis to identify anomalous activities in long-running system executions and extracts long-term features of system states with anomaly scores, presenting better performance than current state-of-the-art methods.