A novel neuro-symbolic framework that achieves superior precision and F1-scores as compared to existing baseline systems by combining the data efficiency of contrastive GNNs with the semantic depth of localized LLMs, providing a scalable, highly accurate, and efficient threat-hunter solution.
Abstract
Advanced Persistent Threats (APTs) increasingly employ “Living-off-the-Land” techniques, rendering traditional signature-based detection ineffective. While query-based threat hunting using system provenance graphs provides essential behavioral context, existing approaches, specifically Graph Neural Network (GNN) based methods, can suffer from a critical vulnerability to structural mimicry, where benign administrative tasks topologically resemble malicious campaigns. Large Language Models (LLMs) offer the deep semantic reasoning required to resolve this ambiguity, but applying them to raw enterprise logs is constrained by prohibitive latency, limited context, and data privacy constraints. In this paper, we propose a novel neuro-symbolic framework that bridges this gap via a highly efficient two-stage cascade architecture. First, a self-supervised contrastive Graph Isomorphism Network with Edge features (GINE) acts as a high-recall structural filter. Trained on a curated dataset of just 24,000 subgraphs, which is much smaller than those used by existing supervised learning-based approaches, our encoder learns robust representations resilient to graph noise and successfully eliminates 87% to over 99% of the benign structural mimics in our curated test sets. Second, the reduced candidate set is processed by a localized LLM utilizing deterministic artifact matching and constrained Chain-of-Thought (CoT) behavioral matching for semantic reasoning. Evaluated across diverse operating systems (Windows, Linux, FreeBSD) using our curated test sets from the DARPA TC3 and OpTC datasets, our framework achieves superior precision and F1-scores as compared to existing baseline systems. By combining the data efficiency of contrastive GNNs with the semantic depth of localized LLMs, we provide a scalable, highly accurate, and efficient threat-hunting solution.
TGL-APT effectively balances detection performance, computational efficiency, and investigation capability for provenance-based APT analysis, and is demonstrated to reduce training time, detection latency, and memory usage compared with KAIROS.
Jing Chen, Ayong Ye, Yuan-Huang Liu et al.· 0 citations
A systematic evaluation of privacy risks in LLM-enhanced GNNs through a unified framework consisting of five stages and reveals that semantic enrichment amplifies link-, label-, and membership-related signals in the embedding space, making them more exploitable by inference attacks.
Longzhu He, Zekun Wen, Chaozhuo Li et al.· 0 citations
Experimental results show that LLMs, when guided by rubric-based prompts and supplemented with ATT&CK domain knowledge, achieve robust performance across detection, localization, and TTP mapping tasks.
Joon-Young Gwak, Aubrey Strier, Zhaohan Xi et al.· 0 citations
This work introduces a novel foundation model for TAG anomaly detection featuring decoupled topological and textual prototypes and constructs dual prototype banks to independently model structural normality and semantic consistency, effectively isolating anomaly cues that are otherwise diluted during coupled aggregation.
Ziyang Wang, Liwen Wu, Cheng Xie et al.· 0 citations
Graph Neural Networks (GNNs) serve as the backbone for high-stakes applications in Machine-Learning-as-a-Service (MLaaS). Still, their black-box deployment exposes them to Model Extraction (ME) attacks, in which adversaries steal intellectual property by querying APIs. Existing defenses suffer from a critical ''Euclidean bias'': they transfer image-based strategies (e.g., random noise) to graphs, ignoring the complex topological dependencies between nodes, which often results in severe utility degradation. Passive methods like watermarking also fail to prevent theft in real time. To bridge this gap, we propose GraphRP (Graph Reprogramming Protection), a proactive defense framework that repurposes Model Reprogramming for security. Unlike static perturbations, GraphRP introduces a Structure-Aware Gating Mechanism driven by learnable topological prototypes. This creates a dynamic ''structural firewall'' that selectively modulates the model's decision boundary: it preserves fidelity for benign queries residing on the training manifold, while maximizing the Fisher Information along the perturbation direction for adversarial queries. Under standard assumptions (bounded loss, optimal attacker, and local second-order approximation), we prove a lower bound on the attacker's estimation error that increases with the structural sensitivity of the reprogramming noise. Extensive experiments on both hard-label and soft-label ME attacks demonstrate that GraphRP significantly degrades attack effectiveness while preserving benign utility.
Yan Wen, Zhenyi Wang, Heng Huang· Proceedings of the 32nd ACM...· 0 citations
Smart contracts operate in decentralized environments where deployed code cannot be easily modified, making security vulnerabilities particularly critical. Even minor logical flaws may lead to severe financial and operational consequences. Although traditional static analysis and symbolic execution techniques have been widely used for vulnerability detection, they often rely on handcrafted rules and struggle to generalize to complex or evolving contract patterns. Recent deep learning approaches have improved detection performance by learning representations directly from code, yet many of these models treat source code primarily as token sequences or graph structures in isolation, limiting their ability to capture deeper semantic interactions. We propose Topology-Guided Contextual Representation Network (TCRNet), a Contextual Encoding Network framework for smart contract vulnerability detection. The model integrates multi-granular semantic information and structural dependency knowledge directly into the attention mechanism. Experiments conducted on a large-scale dataset derived from SmartBugs demonstrate that the proposed approach significantly outperforms traditional static tools and recent learning-based methods. TCRNet achieves an accuracy of 90.14% and a macro F1-score of 94.67%, showing substantial improvements over strong baselines. These results indicate that integrating semantic richness and structural awareness within a Contextual Encoding Network architecture enhances both detection reliability and generalization capability, making the framework suitable for practical smart contract security analysis.
R. S, Mahantesh Mathapati· Journal of Artificial Intell...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
