A Dynamic Graph Neural Network Framework for Advanced Persistent Threat Detection in Cloud Computing

Abstract

Advanced Persistent Threats (APTs) are highly sophisticated and constantly evolving attacks that are difficult to detect using traditional static intrusion detection systems. This study introduces a novel framework called Dynamic Graph Neural Network (Dynamic-GNN) for detecting anomalous behaviors associated with APTs using temporal network and provenance data. The framework constructs cybersecurity temporal graphs and integrates dynamic graph representation learning, attention-based aggregation, and adaptive benign-reference updating to capture behavioral changes over time. The proposed framework was evaluated on the CICIDS2017 and DARPA Transparent Computing benchmark datasets using consistent training, validation, and testing procedures. The evaluation metrics included accuracy, precision, recall, F1-score, and AUC. The proposed approach achieved 94.70% accuracy, 94.41% precision, 94.63% recall, and 94.52% F1-score. Although the framework performed slightly better than the best baseline under the tested conditions, the improvement was not statistically significant enough to establish consistent superiority. The results support the potential of adaptive dynamic graph learning for detecting evolving anomalies and emphasize the need for further evaluation of deployment time, base-rate estimation, and real-world cybersecurity scenarios.