MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning

• DOI: 10.48550/arxiv.2310.09831
• Publication Date: 2023-01-01
• Authors: Jia, Zian; Xiong, Yun; Nan, Yuhong; Zhang, Yao; Zhao, Jinjing; Wen, Mi
• Keywords: FOS: Computer and information sciences; Computer Science - Machine Learning; Computer Science - Cryptography and Security; Cryptography and Security (cs.CR); Machine Learning (cs.LG)

18 pages, 13 figures, to appear in the 33rd USENIX Security Symposium (USENIX Security 2024)<br/>Advance Persistent Threats (APTs), adopted by most delicate attackers, are becoming increasing common and pose great threat to various enterprises and institutions. Data provenance analysis on provenance graphs has emerged as a common approach in APT detection. However, previous works have exhibited several shortcomings: (1) requiring attack-containing data and a priori knowledge of APTs, (2) failing in extracting the rich contextual information buried within provenance graphs and (3) becoming impracticable due to their prohibitive computation overhead and memory consumption. In this paper, we introduce MAGIC, a novel and flexible self-supervised APT detection approach capable of performing multi-granularity detection under different level of supervision. MAGIC leverages masked graph representation learning to model benign system entities and behaviors, performing efficient deep feature extraction and structure abstraction on provenance graphs. By ferreting out anomalous system behaviors via outlier detection methods, MAGIC is able to perform both system entity level and batched log level APT detection. MAGIC is specially designed to handle concept drift with a model adaption mechanism and successfully applies to universal conditions and detection scenarios. We evaluate MAGIC on three widely-used datasets, including both real-world and simulated attacks. Evaluation results indicate that MAGIC achieves promising detection results in all scenarios and shows enormous advantage over state-of-the-art APT detection approaches in performance overhead.<br/>