Cross-Organizational APT Attribution over Federated Heterogeneous Threat Knowledge Graphs
Keywords:
threat attribution, federated learning, threat knowledge graph, graph reasoning, cyber threat intelligenceAbstract
Sophisticated cyber campaigns increasingly span multiple organizations, yet attribution evidence remains fragmented across isolated security silos. This article presents a federated heterogeneous threat knowledge graph framework that enables cross-organizational threat attribution without centralizing sensitive raw telemetry. The architecture aligns entity and relation schemas through a privacy-preserving alignment layer, then performs dual-stream reasoning that combines structural neighborhood propagation with semantic path evidence. A trident-style fusion mechanism integrates three complementary signals: topology-aware message passing, temporal campaign consistency, and cross-graph entity resolution. Experiments on a simulated federation of five organizational subgraphs, containing approximately 1.2 million nodes and 4.7 million edges, show that the proposed approach improves attribution accuracy from 0.71 to 0.89 and reduces false attribution rate from 0.18 to 0.06 compared with single-graph baselines. Ablation results indicate that removing either stream degrades performance by 7 to 13 percentage points, confirming the necessity of dual-stream design. The framework also maintains practical inference latency under 240 milliseconds per query, supporting near-real-time analyst workflows. These findings suggest that federated heterogeneous graph reasoning offers a viable path toward collaborative, privacy-aware cyber threat attribution across organizational boundaries.References
1. M. Mrabet, "TrustFed-CTI: A trust-aware federated learning framework for privacy-preserving cyber threat intelligence sharing across distributed organizations," Future Internet, vol. 17, no. 11, p. 512, 2025.
2. A. A. Patel, N. Joshi, V. Patel, A. V. D. Pandya, and K. VN, "Federated learning for privacy-preserving threat intelligence sharing in distributed cybersecurity ecosystems," Advanced Engineering Sciences, vol. 58, no. 2, pp. 282–297, 2026.
3. M. Bouhaddi and K. Adi, "Strategic detection of APTs through federated spatio-temporal graph learning and Stackelberg defense," in International Conference on Risks and Security of Internet and Systems. Cham: Springer Nature Switzerland, Oct. 2025, pp. 390–409.
4. Z. Hu, L. Liu, H. Li, C. Song, M. Ge, Q. Guo, et al., "CCLog: Actionable APT forensics via fused log semantics and provenance graph topology," Computer Networks, p. 111660, 2025.
5. X. Cheng, Q. Luo, Y. Pan, Z. Li, J. Zhang, and B. Chen, "Predicting the APT for cyber situation comprehension in 5G-enabled IoT scenarios based on differentially private federated learning," Security and Communication Networks, vol. 2021, no. 1, p. 8814068, 2021.
6. J. Wu, "A Methodological Framework for Training Tool-Aware AI Entertainers for Live Streaming," Artificial Intelligence and Digital Technology, vol. 3, no. 3, pp. 1–12, 2026.
7. A. Hossain and A. S. Mily, "Cyber threat intelligence and attribution: A survey."
8. M. Khule, D. Motwani, and D. Chauhan, "Adaptive threat intelligence: An incremental learning approach for detecting evolving APT attacks," in *2025 International Conference on Advances in Modern Age Technologies for Health and Engineering Science (AMATHE)*. Piscataway, NJ: IEEE, Apr. 2025, pp. 1–6.
9. H. Mohamed, N. Koroniotis, F. Schiliro, and N. Moustafa, "IoT-CAD: A comprehensive digital forensics dataset for AI-based cyberattack attribution detection methods in IoT environments," Ad Hoc Networks, vol. 174, p. 103840, 2025.
10. H. T. Thi, N. D. H. Son, P. T. Duy, N. H. Khoa, K. Ngo-Khanh, and V. H. Pham, "XFedHunter: An explainable federated learning framework for advanced persistent threat detection in SDN," arXiv preprint arXiv:2309.08485, 2023.
11. M. Dehghan and E. Khosravian, "Private federated learning for APT detection in internet of drones," Karafan Journal, vol. 20, no. 3, pp. 465–484, 2023.
12. F. M. Hameed, A. Taurshia, and J. Archpaul, "TC-GAT: Temporal causal graph attention for interpretable APT detection," in *2026 International Conference on Recent Advancement in Electrical, Computer and Communication Technologies (IECCT)*. Piscataway, NJ: IEEE, Apr. 2026, pp. 1–6.
13. W. Ahmed, "Advanced persistent threats (APTs) analysing: Current detection techniques and emerging countermeasures," Intelligence, vol. 2, p. 100011, 2025.
14. H. Mohamed, N. Moustafa, N. Koroniotis, Z. Tari, A. Zomaya, and F. Schiliro, "Fedcad: Federated cyberattack attribution detection for internet of things forensics," IEEE Transactions on Sustainable Computing, 2025.
15. J. Wu, "Personality Is a Training Target: Data Curation and SFT for an Entertaining, Agentic AI Streamer," AI and Data Science Journal, vol. 3, no. 2, pp. 29–36, 2026.
16. T. Wang, W. Tang, Y. Su, and J. Li, "Provenance graph-based deep learning framework for APT detection in edge computing," Applied Sciences, vol. 15, no. 16, p. 8833, 2025.
17. A. Binbusayyis, "NeuralFortress-XFL: Privacy-preserving federated explainable learning for cyber threat intelligence," Electronics, vol. 15, no. 14, p. 3124, 2026.
18. I. A. Fiqrin and T. Hidayat, "Federated continual learning for intrusion detection: A drift-aware benchmark on the Windows-APT 2025 dataset," ARMADA: Jurnal Penelitian Multidisiplin, vol. 4, no. 9, pp. 5385–5394, 2026.
19. W. Zhang, T. Liao, and Y. Feng, "Multi-Agent LLM Collaborative Reasoning and Task Planning for Complex Task Solving," in Proc. IEEE CISAT, 2026, doi: 10.1109/CISAT71030.2026.11682610.
20. Z. Wang et al., "Trident: Dual-Stream APT Attribution over Heterogeneous Threat Knowledge Graphs," Computers & Security, vol. 171, Art. no. 105094, 2026.
21. N. Pitropakis, E. Panaousis, A. Giannakoulias, G. Kalpakis, R. D. Rodriguez, and P. Sarigiannidis, "An enhanced cyber attack attribution framework," in International Conference on Trust and Privacy in Digital Business. Cham: Springer International Publishing, Jul. 2018, pp. 213–228.
22. K. Yadav and A. J. Alzahrani, "FATE-X: A federated transferable and explainable deep learning framework for APT detection in serverless edge environments," Computing, vol. 108, no. 1, p. 3, 2026.
23. Z. Wang, Y. Zhou, H. Liu, J. Qiu, B. Fang, and Z. Tian, "Threatinsight: Innovating early threat detection through threat-intelligence-driven analysis and attribution," IEEE Transactions on Knowledge and Data Engineering, vol. 36, no. 12, pp. 9388–9402, 2024.
24. R. Liu, W. Guo, T. Liao, and X. Fang, "Uncertainty-Aware Adaptive Debate for Robust and Efficient Large Language Model Reasoning," Research Square, preprint, Aug. 2026, doi: 10.21203/rs.3.rs-10581777/v1.
25. P. R. R. Brandao and C. S. Silva, "Detecting APT-induced network anomalies with AI: A hybrid statistical–deep–graph framework," 2025.
