# APT Detection via Hypergraph Attention Network with Community-Based Behavioral Mining
## 1 Introduction  
Nowadays, with the widespread application of digital technologies, APTs (Advanced Persistent Threats) pose a core challenge to the cybersecurity of enterprises, governments, and individuals through zero-day exploit utilization, customized malware, and multi-stage penetration strategies. Because it is characterized by high stealth and destructiveness, building a provenance graph based on kernel logs to detect and trace APTs has become mainstream. However, the provenance graph-based method still has many challenges in apt detection. Data-driven detection methods rely on prior attack patterns and struggle to identify new variants; the rule-driven detection methods lag behind the real-time update mechanisms, failing to adapt to the dynamically evolving structure of attack behaviors. Therefore, the method combining data and rules has become the mainstream of APT detection. Moreover, traditional provenance graph methods are inherently limited by their edge structure, which fails to accurately characterize hierarchical behavioral patterns like interactions among processes, files, and networks [1, 2, 3]. As shown in Figure 1, attack techniques such as T1588 (Data Encrypted), T1588.002 (Abuse of Certificates), and T1490 (Indirect Communication) manifest as overlapping-node interaction networks in provenance graphs [4]. Traditional sub-graph discovery methods strictly partition node membership, leading to aloss of critical semantic information and severely degrading behavioral analysis accuracy, which leads to high false positive and negative rates. Additionally, the high computational complexity caused by large-scale log data further restricts the real-time detection applications of traditional graph analysis methods [5]. As a generalized graph structure, hypergraphs offer a new path to overcoming these bottlenecks through their ability to connect multiple vertices via hyperedges [6]. A single hyperedge can naturally represent composite operations involving multiple entities (e.g., a process creating a file and initiating a network connection), and its hierarchical modeling capability can more accurately capture the high-order semantic correlations of attack behaviors. Transforming provenance graphs into hypergraphs for representation learning is expected to break through the expressive limitations of traditional models and improve the accuracy and efficiency of APT detection. Nonetheless, hypergraph modeling and attack detection for kernel logs still face three core challenges:  
* Behavior Boundary Division (C1): In the provenance graph, there is no clear boundary between which behavior a node or edge belongs to. Data-driven and rule-driven methods cannot accurately distinguish them, resulting in further aggravation of false positives and false negatives. * High-level Behavioral Modeling (C2): Hyperedges need to integrate spatiotemporal features of multi-entity interactions like timestamps, process attributions, and network parameters, but existing methods cannot generalize complex behavioral patterns in dynamic contexts. Traditional rule matching and shallow machine learning struggle to capture deep correlations in cross-modal data. * Heterogeneous Data Fusion (C3): Kernel logs contain multiple entity types (processes, files, registries, network sockets, etc.) which have interactive behaviors featuring heterogeneity and temporal dependencies. Designing targeted approaches to efficiently extract key features and map them into hyperedges remains necessary. To tackle these challenges, we present an approach to APT detection via a Hypergraph Attention Network with community-based behavioral mining. For Challenge 1 (C1), we use the improved LFM algorithm [7] for overlapping community discovery to divide the  
Figure 1: Provenance graph of high-level technical and tactical behaviors. behavior boundaries and generate different behavior subgraphs. For Challenge 2 (C2), we employ a hypergraph to represent behavioral communities, where a hyperedge denotes a behavioral pattern.