With the increasing complexity of cyber attacks, especially advanced persistent threats (APT) that exhibit multi-stage, stealthy, and long-cycle characteristics, traditional provenance methods struggle to effectively capture the semantic associations and causal relationships in attack behaviors. This study addresses the challenges of semantic reasoning and provenance in complex attack scenarios by leveraging the self-attention mechanism of the Transformer model to construct a semantic reasoning-based attack provenance mechanism. The mechanism achieves attack path reconstruction and origin localization through semantic encoding of system logs and network traffic, followed by multi-head attention fusion, significantly improving provenance accuracy while reducing false positive rates. Experiments conducted on multiple public APT datasets demonstrate that the proposed mechanism achieves a provenance accuracy of 95.6%, representing a 12.3% improvement over traditional graph neural network methods, with a 15.8% increase in F1 score. These results provide effective technical support for APT attack provenance and point to new research directions in cybersecurity threat intelligence analysis.
Guo et al. (Sun,) studied this question.