APT Detection Using Graph Neural Networks

This project focuses on detecting Advanced Persistent Threats (APTs) in enterprise systems using Deep Learning and Graph Neural Networks (GNNs). The system combines Graph Attention Networks (GAT) and Long Short-Term Memory (LSTM) networks to analyze both relational and temporal patterns in cybersecurity event data.

The goal of this project is to improve threat detection capabilities by modeling enterprise environments as graphs and learning suspicious behavioral patterns from interconnected system activities.

---

Overview

Traditional security systems often struggle to detect sophisticated multi-stage cyber attacks such as Advanced Persistent Threats (APTs). These attacks typically involve:

• Long-term stealthy behavior
• Lateral movement within enterprise systems
• Multi-stage attack chains
• Complex relationships between entities

This project leverages:

• Graph Neural Networks (GNNs)
• Graph Attention Networks (GAT)
• LSTM-based sequence learning

to detect anomalous activities and threat propagation patterns in enterprise environments.

---

Key Features

• Graph-based modeling of enterprise system activities
• Attention-based learning using Graph Attention Networks (GAT)
• Temporal behavior analysis using LSTM
• Cybersecurity event preprocessing and feature engineering
• Detection of suspicious relational patterns
• Deep learning workflow for threat analysis

---

Technologies Used

• Python
• PyTorch
• Graph Neural Networks (GNN)
• Graph Attention Networks (GAT)
• LSTM
• NumPy
• Pandas
• Scikit-learn

---

Architecture Overview

Graph Attention Network (GAT)

The GAT model is used to learn relationships between connected entities in enterprise environments such as:

• Users
• Devices
• Processes
• Network nodes
• System events

The attention mechanism helps the model focus on important neighboring nodes while learning graph representations.

---

LSTM Network

LSTM layers are used to capture temporal attack behaviors and sequential event patterns over time.

This helps in identifying:

• Multi-stage attacks
• Suspicious behavioral sequences
• Long-term attack persistence

---

Workflow

1. Data Collection
2. Data Preprocessing
3. Graph Construction
4. Feature Engineering
5. GAT-based Graph Learning
6. LSTM-based Temporal Analysis
7. Threat Classification / Detection

---

Project Objectives

• Detect Advanced Persistent Threats in enterprise systems
• Analyze relational and temporal attack behaviors
• Explore the use of GNNs in cybersecurity
• Improve understanding of graph-based deep learning approaches

---

Learning Outcomes

Through this project, I gained experience in:

• Graph Neural Networks
• Attention mechanisms in deep learning
• Sequence modeling with LSTM
• Cybersecurity data analysis
• Deep learning workflows using PyTorch
• Research-oriented AI/ML development

---

Future Improvements

• Real-time threat detection pipeline
• Integration with SIEM systems
• Visualization dashboards for attack graphs
• Larger enterprise-scale datasets
• Transformer-based threat analysis
• Improved graph embedding techniques

---

Author

Kiran Namburi

LinkedIn: https://linkedin.com/in/kirannamburi06

---