ADAPTD: Adaptive Detection and Proactive Threat Defense for Autonomous APT attacks

2026-08-17

AI Summary

针对APT攻击的横向传播问题，提出ADAPTD框架，通过紧凑杀伤链、即时阻断机制和预测性驱逐策略有效检测与防御威胁。

Abstract

Advanced persistent threat (APT) actors increasingly employ sophisticated techniques to propagate laterally through segmented enterprise networks. Timely detection and defense depend on cross-subnetwork coordination, yet maintaining global situational awareness generates substantial communication overhead. To manage this tradeoff, flexible monitoring and adaptable containment are imperative. This paper presents ADAPTD, a communication- and computation-efficient, decision-theoretic framework integrating: (i) compact kill chains for identifying diverse attack vectors, (ii) an immediate blocking mechanism for timely containment, and (iii) a predictive eviction strategy to restore system security. Our experiments validate ADAPTD's effectiveness across diverse threat scenarios. First, our decentralized belief update scheme outperforms state-of-the-art diffusion HMM. Second, ADAPTD substantially reduces false evictions compared to transformer-based detection. Third, under noisy environments, adaptive blocking contains attackers while minimizing unnecessary disruption. Lastly, the ablation study confirms that combining two defensive actions significantly reduces the defender's total cost.

Problem

• APT attacks
• lateral propagation
• cross-subnetwork coordination
• communication overhead
• timely detection and defense

Innovation

• compact kill chains
• immediate blocking mechanism
• predictive eviction strategy