Abstract: With the increasing sophistication and stealth of cyber attacks, particularly the continuous evolution of advanced persistent threats (APT) targeting critical information infrastructure, which are characterized by high concealment and longterm persistence, accurately distinguishing intrusions from normal behavior has become a critical challenge. Provenancebased intrusion detection systems can capture finegrained causal relationships among system entities, demonstrating strong advantages in distinguishing benign from malicious behaviors and uncovering stealthy attacks. However, existing learningbased approaches still suffer from the absence of proper node weighting, insufficient utilization of edge features, and inadequate learning of local subgraph structures, while also facing high computational costs when applied to largescale datasets. To address these limitations, we propose GSCAE, a novel APT detection framework based on a Generative Subgraph Contrastive Autoencoder. First, we construct node representations by integrating edge interaction features with local clustering coefficients and compute node importance using the entropy weight method. Then, we design a generative subgraph contrastive learning algorithm that jointly incorporates edgelevel and topological losses to more effectively learn local structures and interaction patterns. Finally, the learned graph embeddings are fed into a lightweight node classifier to perform anomaly detection, achieving a balance between detection accuracy and computational efficiency. Experiments conducted on the DARPA public dataset demonstrate that GSCAE outperforms most existing learningbased approaches in both accuracy and efficiency, validating its effectiveness and practicality in complex host environments.

Key words: advanced persistent threat; generative subgraph contrastive learning; local subgraph; autoencoder; provenance graph

摘要： 随着网络攻击日益复杂与隐蔽，尤其是针对关键信息基础设施的高级持续性威胁(advanced persistent threats, APT)不断演化，其长期潜伏性与高度隐蔽性使得从正常行为中精准识别入侵成为关键挑战.基于溯源图的入侵检测系统可通过细粒度因果关系刻画系统实体交互，在区分良性与恶意行为、识别隐蔽攻击方面具有显著优势.然而，现有学习型方法仍存在节点权重缺失、边特征利用不足和局部子图学习不充分问题，并在大规模数据训练中面临高计算开销.为此，提出一种基于生成子图对比自编码器(generative subgraph contrastive autoencoder, GSCAE)的APT检测方法.首先构建结合边交互特征与局部聚类系数的节点特征，并利用熵权法量化节点重要性；然后设计生成子图对比学习算法，同时引入边损失与拓扑损失以更充分学习局部结构与交互模式；最后将图嵌入输入轻量级节点分类器实现异常检测，在保证检测精度的同时兼顾计算效率.基于DARPA公共数据集的实验表明，GSCAE在检测精度与效率上均优于现有多数学习方法，验证了其在复杂主机环境下的有效性与实用性.

关键词: 高级持续性威胁；生成子图对比学习；局部子图；自编码器；溯源图