Collaborative APT detection through cloud-edge synergy of graph transformer and lightweight clustering
Year: 2026
Type: article
Abstract: With the increasing stealth and severity of cyberattacks, the demand for advanced persistent threat (APT) detection systems that deeply understand complex system behaviors has grown substantially. However, existing provenance-based methods often struggle to balance prediction accuracy with inference latency across distributed, resource-constrained environments. To address this, we propose CE-GTC , a collaborative intelligence framework that synergizes large and small models across the cloud-edge continuum. Specifically, the system constructs provenance graphs to capture causal system interactions. In the cloud, a heavy Graph Transformer (the large model) performs computationally intensive representation learning—utilizing edge-feature injection and self-supervised objectives—to extract discriminative embeddings and compact normal behavior profiles. Meanwhile, edge devices host a lightweight clustering detector (the small model) for real-time, privacy-aware anomaly detection via Inverse Document Frequency (IDF)-weighted hybrid distance computation against multi-cluster centers. Experimental evaluations on the Unicorn Wget and StreamSpot datasets demonstrate that CE-GTC achieves superior performance, including an F1-score up to 0.974 and response latency under one second. This highlights the effectiveness of large-small model synergy for scalable, secure, and intelligent APT detection.
Authors: Chong Ruan, Chunsun Tian, Zhijun Liu, Dan Wang, Po Wu, Lei Yang
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $1,790
OpenAlex ID: W7165135789