# APT Detection via Hypergraph Attention Network with Community-Based Behavioral Mining
## 9 Evaluation
### Runtime Overhead  
The performance of runtime overhead is shown in Table 7. In this experiment, we repeated the experiment and took the average value as the experimental result. Each stage's time consumption and memory usage reflect the differences in the complexity of different operations and resource requirements. The overlapping community detection stage consumes less time and memory because this stage mainly performs a preliminary analysis of data based on relatively simple algorithms and does not involve complex model training. In this stage, only some basic features in the data are extracted and a preliminary community division is carried out, without the need to handle a large number of parameters and complex calculations like in subsequent stages. During training, the process takes 1285 s and uses 2.71 GB of memory, mainly due to the hypergraph-based dual-attention mechanism. Hypergraphs effectively model high-order relationships and complex structures, where node-level attention highlights critical \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Dataset** & **Model** & **Accuracy** & **F1-Score** & **FPR** & **AUC** \\ \hline \multirow{7}{*}{Theia} & GCN & 0.7520 \(\pm\) 0.0053 & 0.8050 \(\pm\) 0.0101 & 0.2280 \(\pm\) 0.0048 & 0.7580 \(\pm\) 0.0082 \\  & GAT & 0.7890 \(\pm\) 0.0042 & 0.8320 \(\pm\) 0.0075 & 0.2050 \(\pm\) 0.0053 & 0.7810 \(\pm\) 0.0025 \\  & w/o attention & 0.7080 \(\pm\) 0.0016 & 0.7790 \(\pm\) 0.0022 & 0.2314 \(\pm\) 0.0042 & 0.7153 \(\pm\) 0.0018 \\  & w/o behavior semantic & 0.6684 \(\pm\) 0.0042 & 0.7151 \(\pm\) 0.0031 & 0.1557 \(\pm\) 0.0022 & 0.6580 \(\pm\) 0.0032 \\  & HyperGAT (1-layer) & 0.9320 \(\pm\) 0.0010 & 0.9776 \(\pm\) 0.0006 & 0.0082 \(\pm\) 0.0026 & 0.9238 \(\pm\) 0.0017 \\  & HyperGAT & **0.9773 \(\pm\) 0.0018** & **0.9835 \(\pm\) 0.0005** & **0.0012 \(\pm\) 0.0010** & **0.9751 \(\pm\) 0.0014** \\ \hline \multirow{7}{*}{Cadets} & GCN & 0.7750 \(\pm\) 0.0046 & 0.8420 \(\pm\) 0.0082 & 0.1920 \(\pm\) 0.0025 & 0.7760 \(\pm\) 0.0037 \\  & GAT & 0.8060 \(\pm\) 0.0051 & 0.8580 \(\pm\) 0.0046 & 0.1750 \(\pm\) 0.0057 & 0.8020 \(\pm\) 0.0092 \\ \cline{1-1}  & w/o attention & 0.7350 \(\pm\) 0.0037 & 0.8456 \(\pm\) 0.0021 & 0.1268 \(\pm\) 0.0016 & 0.7145 \(\pm\) 0.0007 \\ \cline{1-1}  & w/o behavior semantic & 0.6862 \(\pm\) 0.0116 & 0.7465 \(\pm\) 0.0015 & 0.1024 \(\pm\) 0.0061 & 0.6814 \(\pm\) 0.0057 \\ \cline{1-1}  & HyperGAT (1-layer) & 0.9056 \(\pm\) 0.0083 & 0.9340 \(\pm\) 0.0058 & 0.0614 \(\pm\) 0.0034 & 0.9258 \(\pm\) 0.0016 \\ \cline{1-1}  & HyperGAT & **0.9253 \(\pm\) 0.0006** & **0.9637 \(\pm\) 0.0023** & **0.0016 \(\pm\) 0.0011** & **0.9832 \(\pm\) 0.0038** \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparison of Ablation Results. \begin{table}
\begin{tabular}{l c c} \hline \hline
**Stage** & **Time Consumption (s)** & **Memory Usage (GB)** \\ \hline Overlapping Community Detection & 38 & 0.59 \\ Training & 1285 & 2.71 \\ Testing & 875 & 3.87 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: The Result of Performance Overhead. nodes and edge-level attention emphasizes key hyperedges. The mechanism's complex computations on numerous nodes/edges for importance weights, combined with parameter optimization and large-scale dataset iterations, drive resource consumption. During testing, it takes 875 s with memory usage rising to 3.87 GB. Despite no parameter updates, the model's complexity and hypergraph structure require complex inference computations, including loading trained parameters, processing input data, and generating predictions. Notably, the dataset was collected over 24 h. For shorter data collection windows like sub-hourly snapshots, the volume of data is correspondingly smaller. In such scenarios, the method's computational overhead decreases significantly due to the reduced scale of input data.