TGCM: Topic-Guided Generative Disentanglement of Interleaved APT Technique Sequences

2026-06-16

AI Summary

This work addresses the challenge of disentangling interleaved technical sequences arising from concurrent APT campaigns in enterprise environments—specifically, reconstructing individual APT activity chains from mixed logs without prior knowledge of the number of attacks. The authors propose a generative decoupling framework that, for the first time, integrates topic-guided consistency modeling into APT sequence demixing by leveraging MITRE ATT&CK tactical narratives as thematic priors to directly map intertwined sequences into structured, single-activity attack chains. The approach requires no pre-specified attack count, enables end-to-end single-step inference, and generalizes to real-world scenarios under zero-shot settings. Experiments demonstrate that the method significantly outperforms 15 baselines across synthetic, mixed, and real DARPA TC-E3/E5 datasets, exhibiting superior robustness in high-interleaving and technique-sharing conditions as well as strong out-of-domain generalization.

Abstract

In enterprise environments, multiple Advanced Persistent Threat (APT) campaigns often unfold concurrently, producing audit logs in which attack techniques across actors (sources) are interleaved over time. This setting naturally gives rise to an Unknown-K Interleaved Sequence Demixing (UKISD) problem: recovering multiple latent campaigns from an interleaved technique sequence while jointly inferring their number and technique-level assignments. Existing approaches, ranging from statistical pattern mining to provenance-based analysis, typically assume single-campaign settings or rely on rigid heuristics, limiting their effectiveness under realistic conditions involving overlapping campaigns, shared techniques, and variable execution lengths. We present Topic-Guided Consistency Modeling (TGCM), a generative disentanglement framework to tackle the UKSID problem. TGCM leverages Consistency Models to learn a direct inverse mapping from interleaved multi-campaign observations to structured single-campaign sequences in a single inference step. To favor semantically coherent attack chains, TGCM incorporates a topic-guided prior derived from MITRE ATT\&CK narratives, providing high-level tactical constraints during decomposition. We evaluate TGCM on synthetic datasets, established mixed datasets, and incident traces from DARPA TC-E3 and TC-E5, comparing against 15 representative baselines spanning pattern mining, deep learning, and LLM-based methods. Results indicate improved separation robustness over baselines under heavy interleaving and technique sharing, and show that TGCM generalizes zero-shot to a naturally interleaved in-the-wild benchmark (DARPA TC-E5) without retraining.

Problem

• Advanced Persistent Threat
• Interleaved Sequence Demixing
• Attack Technique Disentanglement
• Audit Log Analysis
• Unknown-K Demixing

Innovation

• Consistency Models
• Generative Disentanglement
• Topic-Guided Prior
• Interleaved Sequence Demixing
• APT Campaign Reconstruction