Traditional detection methods and security defenses are gradually insufficient to cope with evolving attack techniques and strategies, and have coarse detection granularity and high memory overhead. As a result, we propose Sylph, a lightweight unsupervised APT detection method based on a provenance graph, which not only detects APT attacks but also localizes APT attacks with a fine event granularity and feeds possible attacks back to system detectors to reduce their localization burden. Sylph proposes a whole-process architecture from provenance graph collection to anomaly detection, starting from the system audit logs, and dividing subgraphs based on time slices of the provenance graph it transforms into to reduce memory overhead. Starting from the system audit logs, the provenance graph it transforms into is divided into subgraphs based on time slices, which reduces the memory occupation and improves the detection efficiency at the same time; on the basis of generating the sequence of subgraphs, the full graph embedding of the subgraphs is carried out by using Graph2Vec to obtain their feature vectors, and the anomaly detection based on unsupervised learning is carried out by using an autoencoder, which is capable of detecting new types of attacks that have not yet appeared. After the experimental evaluation, Sylph can realize the APT attack detection with higher accuracy and achieve an accuracy rate.

Network security is crucial for national infrastructure, but the increasing number of network intrusions poses significant challenges. To address this issue, we propose Open DGML, a framework based on open-domain generalization meta-learning for intrusion detection. Our approach incorporates flow imaging, data augmentation, and open-domain generalization meta-learning algorithms. Experimental results on the ISCX2012, NDSec-1, CICIDS2017, and CICIDS2018 datasets demonstrate the effectiveness of Open DGML. Compared to state-of-the-art models (HAST-IDS, CLAIRE, FC-Net), Open DGML achieves higher accuracy and detection rates. In closed-domain settings, it achieves an average accuracy of 96.52% and a detection rate of 97.04%. In open-domain settings, it achieves an average accuracy of 68.73% and a detection rate of 61.49%. These results highlight the superior performance of Open DGML, particularly in open-domain scenarios, for effective identification of various network attacks.