GA-ConvE: An APT attack prediction method based on combination of graph attention network and 2D convolution

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Graph Neural Networks

Background:

• Advanced Persistent Threat (APT) attacks pose a significant cybersecurity challenge.
• Accurate and timely prediction of APT attacks is crucial for effective defense.
• Existing methods may struggle with feature loss in deep graph networks and large inference spaces.

Purpose of the Study:

• To propose a novel APT attack prediction method, GA-ConvE.
• To enhance the classification of APT behaviors using a residual multi-layer graph attention network (RMultiGAT).
• To improve the accuracy and interpretability of APT attack predictions through a joint graph attention network and 2D convolution model.

Main Methods:

• Constructing an attack behavior knowledge graph from APT threat intelligence.
• Utilizing a residual multi-layer graph attention network (RMultiGAT) for classifying APT behaviors.
• Employing a joint prediction model (GA-ConvE) combining graph attention networks and 2D convolution for inference.

Main Results:

• The RMultiGAT effectively classifies APT behaviors by mitigating feature loss in deep graph networks.
• The GA-ConvE model achieves accurate and interpretable APT attack predictions by extracting targeted behavioral features.
• Experimental validation demonstrates the effectiveness of GA-ConvE in real-world scenarios.

Conclusions:

• The GA-ConvE method offers a significant advancement in predicting Advanced Persistent Threat attacks.
• This approach enhances cybersecurity by improving real-time response capabilities against sophisticated threats.
• The combination of knowledge graphs, RMultiGAT, and GA-ConvE provides a robust framework for APT attack prediction.