APT-LLM: Embedding-Based Anomaly Detection of Cyber Advanced Persistent Threats Using Large Language Models

2025-02-13

AI Summary

Advanced Persistent Threat (APT) attacks exhibit strong stealth in highly imbalanced system logs (positive samples as low as 0.004%), leading to high false positives and severe false negatives in conventional anomaly detection methods. To address this, we propose the first end-to-end anomaly detection framework that leverages pre-trained language models (BERT, ALBERT, DistilBERT, RoBERTa) for semantic embedding of process provenance traces. Our method jointly integrates large language model (LLM) representations with autoencoders (AE, VAE, DAE) to automatically learn the distribution of benign behavior—eliminating reliance on manual feature engineering. Evaluated on the DARPA Transparent Computing dataset—a multi-platform, real-world provenance corpus spanning Android, Linux, BSD, and Windows—our framework achieves significant improvements in both precision and recall. This work constitutes the first empirical validation of LLM-based semantic embeddings for cross-platform APT detection, demonstrating their effectiveness and generalizability.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Safety and Robustness
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Security and Privacy: Data transparency and provenance
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

Advanced Persistent Threats (APTs) pose a major cybersecurity challenge due to their stealth and ability to mimic normal system behavior, making detection particularly difficult in highly imbalanced datasets. Traditional anomaly detection methods struggle to effectively differentiate APT-related activities from benign processes, limiting their applicability in real-world scenarios. This paper introduces APT-LLM, a novel embedding-based anomaly detection framework that integrates large language models (LLMs) -- BERT, ALBERT, DistilBERT, and RoBERTa -- with autoencoder architectures to detect APTs. Unlike prior approaches, which rely on manually engineered features or conventional anomaly detection models, APT-LLM leverages LLMs to encode process-action provenance traces into semantically rich embeddings, capturing nuanced behavioral patterns. These embeddings are analyzed using three autoencoder architectures -- Baseline Autoencoder (AE), Variational Autoencoder (VAE), and Denoising Autoencoder (DAE) -- to model normal process behavior and identify anomalies. The best-performing model is selected for comparison against traditional methods. The framework is evaluated on real-world, highly imbalanced provenance trace datasets from the DARPA Transparent Computing program, where APT-like attacks constitute as little as 0.004% of the data across multiple operating systems (Android, Linux, BSD, and Windows) and attack scenarios. Results demonstrate that APT-LLM significantly improves detection performance under extreme imbalance conditions, outperforming existing anomaly detection methods and highlighting the effectiveness of LLM-based feature extraction in cybersecurity.

Problem

• Detects Advanced Persistent Threats using LLMs
• Improves anomaly detection in imbalanced datasets
• Leverages embeddings for nuanced behavioral pattern analysis

Innovation

• LLMs for APT detection
• Autoencoder architectures integration
• Semantic-rich embeddings analysis