Year: 2025
Type: article
Abstract: Advanced Persistent Threats (APTs) exhibit covert behaviors, long attack cycles, and fragmented intelligence, creating challenges for correlation analysis and attribution. This work proposes a unified knowledge-graph-based framework for multi-level APT correlation. We construct an APT ontology and automatically extract entities and relations from threat reports using NER and relation extraction models. The resulting multi-source intelligence is normalized and integrated into a Neo4j knowledge graph containing 15,682 entities and 42,713 relations. Multi-level correlation analysis is then performed through explicit structural reasoning, semantic embedding models such as TransE and RotatE, and a temporal evolution module based on T-GCN to capture dynamic attack-path patterns. Experiments demonstrate that the proposed framework achieves an F1-score of 0.91 for relation extraction and improves APT correlation prediction accuracy by 17.3% over rule-based baselines. The system supports large-scale attack-chain reasoning and sector-oriented threat analysis, providing enhanced attribution and decision support for cybersecurity defense.
Source: Electronics
Authors: Haohui Su, Xuan Zhang, Lincheng Li, Lvjun Zheng
Institution: China Southern Power Grid (China)
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $2,896
OpenAlex ID: W7117113012
FWCI:
Cites:
Cited by:
Related to: