XAPT: Explainable Anomaly-Driven Prediction of Threat Stages in APT Campaigns

Advanced Persistent Threats (APTs) are long-lived, targeted cyberattacks that progress through multiple stages, characterized by strong stealth and intent. To achieve accurate and interpretable stage-level prediction, we propose XAPT, an eXplainable, anomaly-driven framework for APT campaign analysis. XAPT is centered on three key innovations. First, we derive PCA-based reconstruction errors and transform them into calibrated probabilistic anomaly scores, enabling principled quantification of the event abnormality. Second, these calibrated scores are incorporated into a Bayesian Network-based multiclass classifier for cyber-kill-chain stage inference, capturing uncertainty and inter-feature dependencies. Third, SHAP-based feature attribution reveals how anomaly scores and other features contribute to classification outcomes, offering transparent and analytically friendly explanations. Evaluation of two public datasets shows that XAPT achieves high stage-level detection accuracy while producing actionable feature-level interpretations that support operational analysis. By unifying calibrated anomaly scoring, Bayesian inference, and SHAP explanation, XAPT offers a comprehensive and interpretable solution for advanced threat detection.