The DOI matches its DataCite record; 1 of the 1 references it cites were found in a registry or an index.
MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning
Open accessAbstract
Advance Persistent Threats (APTs), adopted by most delicate attackers, are becoming increasing common and pose great threat to various enterprises and institutions. Data provenance analysis on provenance graphs has emerged as a common approach in APT detection. However, previous works have exhibited several shortcomings: (1) requiring attack-containing data and a priori knowledge of APTs, (2) failing in extracting the rich contextual information buried within provenance graphs and (3) becoming impracticable due to their prohibitive computation overhead and memory consumption. In this paper, we introduce MAGIC, a novel and flexible self-supervised APT detection approach capable of performing multi-granularity detection under different level of supervision. MAGIC leverages masked graph representation learning to model benign system entities and behaviors, performing efficient deep feature extraction and structure abstraction on provenance graphs. By ferreting out anomalous system behaviors via outlier detection methods, MAGIC is able to perform both system entity level and batched log level APT detection. MAGIC is specially designed to handle concept drift with a model adaption mechanism and successfully applies to universal conditions and detection scenarios. We evaluate MAGIC on three widely-used datasets, including both real-world and simulated attacks. Evaluation results indicate that MAGIC achieves promising detection results in all scenarios and shows enormous advantage over state-of-the-art APT detection approaches in performance overhead.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“These challenges have led to the development of graph neural frameworks that incorporate heterogeneous modeling and dynamic reasoning. [1], [25], [26], [34]”
From A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection (2025) · cites this paper as [26]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“A major challenge is label scarcity and imbalance: malicious events are rare and costly to annotate, while benign activities dominate most datasets [26], [36].”
From A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection (2025) · cites this paper as [26]
Experimental — accuracy not yet measuredThe cited source says what the claim attributes to it.
In the citing paper
“MAGIC[34] proposed a masked graph representation learning framework, self-supervisedly learning the deep topological patterns of normal system behaviors through random masking and reconstruction on benign provenance graphs.”
From From Correlation to Intervention: A Survey on Log-Based Causal Analysis for Security and AIOps (2026) · cites this paper as [34]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats
Han, X., Pasquier, T., Bates, A., Mickens, J., & Seltzer, M. (2020) · Proceedings 2020 Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.24046 · Cited by 349
Research works printed but not linked: 45
- Adel Alshamrani, Sowmya Myneni, Ankur Chowdhary, et al. A survey on advanced persistent threats: Tech- niques, solutions, challenges, and research opportunities. IEEE Communications Surveys & Tutorials, 2019.
- Wajih Ul Hassan, Adam Bates, and Daniel Marino. Tac- tical provenance analysis for endpoint detection and re- sponse systems. In 2020 IEEE Symposium on Security and Privacy (SP), 2020.
- Sadegh M Milajerdi, Rigel Gjomemo, Birhanu Eshete, et al. Holmes: real-time apt detection through corre- lation of suspicious information flows. In 2019 IEEE Symposium on Security and Privacy (SP), 2019.
- Md Nahid Hossain, Sadegh M Milajerdi, Junao Wang, et al. Sleuth: Real-time attack scenario reconstruction from cots audit data. In USENIX Security Symposium, 2017.
- Sadegh M Milajerdi, Birhanu Eshete, Rigel Gjomemo, et al. Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, 2019.
- Md Nahid Hossain, Sanaz Sheikhi, and R Sekar. Com- bating dependence explosion in forensic analysis using alternative tag propagation semantics. In 2020 IEEE Symposium on Security and Privacy (SP), 2020.
- Wajih Ul Hassan, Shengjian Guo, Ding Li, et al. Nodoze: Combatting threat alert fatigue with automated prove- nance triage. In network and distributed systems security symposium, 2019.
- Qi Wang, Wajih Ul Hassan, Ding Li, et al. You are what you do: Hunting stealthy malware via data provenance analysis. In NDSS, 2020.
- Yushan Liu, Mu Zhang, Ding Li, et al. Towards a timely causality analysis for enterprise security. In NDSS, 2018.
- Abdulellah Alsaheel, Yuhong Nan, Shiqing Ma, et al. Atlas: A sequence-based learning approach for attack investigation. In USENIX Security Symposium, 2021.
- Kexin Pei, Zhongshu Gu, Brendan Saltaformaggio, et al. Hercule: Attack story reconstruction via community dis- covery on correlated log graph. In Proceedings of the 32Nd Annual Conference on Computer Security Appli- cations, 2016.
- Yun Shen, Enrico Mariconti, Pierre Antoine Vervier, et al. Tiresias: Predicting security events through deep learning. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018.
- Fucheng Liu, Yu Wen, Dongxue Zhang, et al. Log2vec: A heterogeneous graph embedding based approach for detecting cyber threats within enterprise. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, 2019.
- Maya Kapoor, Joshua Melton, Michael Ridenhour, et al. Prov-gem: Automated provenance analysis framework using graph embeddings. In 2021 20th IEEE Interna- tional Conference on Machine Learning and Applica- tions (ICMLA), 2021.
- Su Wang, Zhiliang Wang, Tao Zhou, et al. Threatrace: Detecting and tracing host-based threats in node level through provenance graph learning. IEEE Transactions on Information Forensics and Security, 2022.
- Jun Zengy, Xiang Wang, Jiahao Liu, et al. Shadewatcher: Recommendation-guided cyber threat analysis using sys- tem audit records. In 2022 IEEE Symposium on Security and Privacy (SP), 2022.
- Zhenyu Hou, Xiao Liu, Yuxiao Dong, et al. Graph- mae: Self-supervised masked graph autoencoders. arXiv preprint arXiv:2205.10803, 2022. · arXiv
- Zhang Xu, Zhenyu Wu, Zhichun Li, et al. High fidelity data reduction for big data security dependency analyses. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016.
- Hailun Ding, Juan Zhai, Yuhong Nan, and Shiqing Ma. Airtag: Towards automated attack investigation by un- supervised learning with log texts. In 32nd USENIX Security Symposium (USENIX Security 23), pages 373- 390, 2023.
- Thomas N Kipf and Max Welling. Variational graph auto-encoders. arXiv preprint arXiv:1611.07308, 2016. · arXiv
- Jiwoong Park, Minsik Lee, Hyung Jin Chang, et al. Sym- metric graph convolutional autoencoder for unsuper- vised graph representation learning. In Proceedings of the IEEE/CVF international conference on computer vision, 2019.
- Amin Salehi and Hasan Davulcu. Graph attention auto- encoders. arXiv preprint arXiv:1905.10715, 2019. · arXiv
- Keyulu Xu, Weihua Hu, Jure Leskovec, et al. How powerful are graph neural networks? arXiv preprint arXiv:1810.00826, 2018. · arXiv
- Petar Veličković, Guillem Cucurull, Arantxa Casanova, et al. Graph attention networks. arXiv preprint arXiv:1710.10903, 2017. · arXiv
- Chuang Liu, Yibing Zhan, Chang Li, et al. Graph pool- ing for graph neural networks: Progress, challenges, and opportunities. arXiv preprint arXiv:2204.07321, 2022. · arXiv
- Xiao Wang, Nian Liu, Hui Han, et al. Self-supervised heterogeneous graph neural network with co-contrastive learning. In Proceedings of the 27th ACM SIGKDD con- ference on knowledge discovery & data mining, 2021.
- Jon Louis Bentley. Multidimensional binary search trees used for associative searching. Communications of the ACM, 1975.
- Emaad Manzoor, Sadegh M Milajerdi, and Leman Akoglu. Fast memory-efficient anomaly detection in streaming heterogeneous graphs. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2016.
- Thomas Pasquier, Xueyuan Han, Mark Goldstein, et al. Practical whole-system provenance capture. In Pro- ceedings of the 2017 Symposium on Cloud Computing, 2017.
- Joud Khoury, Timothy Upthegrove, Armando Caro, et al. An event-based data model for granular information flow tracking. In Proceedings of the 12th USENIX Confer- ence on Theory and Practice of Provenance, 2020.
- Aric A. Hagberg, Daniel A. Schult, and Pieter J. Swart. Exploring network structure, dynamics, and function using networkx. In Proceedings of the 7th Python in Science Conference, 2008.
- Adam Paszke, Sam Gross, Francisco Massa, et al. Py- torch: An imperative style, high-performance deep learn- ing library. In Advances in Neural Information Process- ing Systems 32. 2019.
- Minjie Wang, Da Zheng, Zihao Ye, et al. Deep graph library: A graph-centric, highly-performant pack- age for graph neural networks. arXiv preprint arXiv:1909.01315, 2019. · arXiv
- F. Pedregosa, G. Varoquaux, A. Gramfort, et al. Scikit- learn: Machine learning in Python. Journal of Machine Learning Research, 2011.
- Vara Prasad, William Cohen, FC Eigler, et al. Locating system problems using dynamic instrumentation. In 2005 Ottawa Linux Symposium, 2005.
- Yankai Lin, Zhiyuan Liu, Maosong Sun, et al. Learning entity and relation embeddings for knowledge graph completion. In Proceedings of the AAAI conference on artificial intelligence, 2015.
- Larry M Manevitz and Malik Yousef. One-class svms for document classification. Journal of machine Learn- ing research, 2001.
- Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isola- tion forest. In 2008 eighth ieee international conference on data mining, 2008.
- Xueyuan Han, Xiao Yu, Thomas Pasquier, et al. Sigl: Se- curing software installations through deep graph learn- ing. In 30th USENIX Security Symposium (USENIX Security 21), 2021.
- Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907, 2016. · arXiv
- Will Hamilton, Zhitao Ying, and Jure Leskovec. Induc- tive representation learning on large graphs. Advances in neural information processing systems, 2017.
- Markus M Breunig, Hans-Peter Kriegel, Raymond T Ng, et al. Lof: identifying density-based local outliers. In Proceedings of the 2000 ACM SIGMOD international conference on Management of data, 2000.
- Panpan Zheng, Shuhan Yuan, Xintao Wu, et al. One- class adversarial nets for fraud detection. In Proceedings of the AAAI Conference on Artificial Intelligence, 2019.
- Zakia Ferdousi and Akira Maeda. Unsupervised outlier detection in time series data. In 22nd International Con- ference on Data Engineering Workshops (ICDEW'06), 2006.
- Jun Zeng, Zheng Leong Chua, Yinfang Chen, et al. Wat- son: Abstracting behaviors from audit logs via aggrega- tion of contextual semantics. In NDSS, 2021.
Cited by
Sorted by citations
A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection
Jiang, L., Ryan, R., Li, Q., & Ferdosian, N. (2025) · arXiv · doi:10.48550/arxiv.2510.26307 · Cited by 13
From Correlation to Intervention: A Survey on Log-Based Causal Analysis for Security and AIOps
Zhu, Y., Li, X., Suo, J., Yin, Y., & Huang, C. (2026) · 2026 International Conference on AI in Education Technology and Applications (AIETA) · doi:10.1109/aieta69357.2026.11508946
Metadata
- Authors
- Jia, Z., Xiong, Y., Nan, Y., Zhang, Y., Zhao, J., & Wen, M.
- Affiliations
- Fudan University (CN)
- Sun Yat-sen University (CN)
- Shanghai University of Electric Power (CN)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2023
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2310.09831
- OpenAlex
- W4387724174
- Cited by
- 17
- References
- 1
- Citations by year
- 2025: 12 · 2024: 5
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Natural Science Foundation of China (62032025, 21XD1421500, U1936213)
- Sun Yat-sen University (22lgqb26)
- Fundamental Research Funds for the Central Universities (62032025)
- Program of Shanghai Academic Research Leader (U1936213, 21XD1421500)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- advanced persistent threats, APT detection, provenance graphs, self-supervised learning, outlier detection, concept drift, model adaptation, intrusion detection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
