OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMs

TL;DR

OCR-APT addresses the dual challenge of detecting APTs in large, heterogeneous provenance graphs and producing human-readable attack narratives. It combines a GNN-based subgraph anomaly detector (OCRGCN) that learns behavioral patterns while avoiding brittle node attributes with an LLM-based attack investigator that uses a Retrieval-Augmented Generation pipeline to serialize subgraphs, extract IOCs, map actions to APT stages, and generate stage-wise reports. The approach emphasizes robustness to evasion through edge-type-aware embeddings and per-node-type models, and it mitigates LLM hallucinations via modular prompts and automatic validation. Evaluations on DARPA TC3, OpTC, and NODLINK show high detection F1-scores and improved interpretability of alerts, with LLM-generated reports covering most attack stages and articulating IOCs and contextual narratives. Overall, OCR-APT advances practical APT defense by translating low-level provenance data into actionable, narrative intelligence that supports analyst workflows, scalability, and robustness against surface-level evasion.

Abstract

Advanced Persistent Threats (APTs) are stealthy cyberattacks that often evade detection in system-level audit logs. Provenance graphs model these logs as connected entities and events, revealing relationships that are missed by linear log representations. Existing systems apply anomaly detection to these graphs but often suffer from high false positive rates and coarse-grained alerts. Their reliance on node attributes like file paths or IPs leads to spurious correlations, reducing detection robustness and reliability. To fully understand an attack's progression and impact, security analysts need systems that can generate accurate, human-like narratives of the entire attack. To address these challenges, we introduce OCR-APT, a system for APT detection and reconstruction of human-like attack stories. OCR-APT uses Graph Neural Networks (GNNs) for subgraph anomaly detection, learning behavior patterns around nodes rather than fragile attributes such as file paths or IPs. This approach leads to a more robust anomaly detection. It then iterates over detected subgraphs using Large Language Models (LLMs) to reconstruct multi-stage attack stories. Each stage is validated before proceeding, reducing hallucinations and ensuring an interpretable final report. Our evaluations on the DARPA TC3, OpTC, and NODLINK datasets show that OCR-APT outperforms state-of-the-art systems in both detection accuracy and alert interpretability. Moreover, OCR-APT reconstructs human-like reports that comprehensively capture the attack story.

Figures (8)

• Figure 1: Overall architecture of OCR-APT. This includes constructing provenance graphs (PG), extracting features and encoding the graph into a PyTorch Geometric data object (PYG), detecting anomalous nodes (A-Nodes) with our GNN-based model (OCRGCN), identifying anomalous subgraphs (A-SGs), and generating a human-like APT attack report using LLMs.
• Figure 2: Architecture of the OCRGCN model. The training phase (left) involves encoding benign provenance graphs, estimating contamination factors, learning node embeddings via RGCN layers, and learning the normal hypersphere with a one-class SVM. The inference phase (right) uses the trained models to compute anomaly scores and detect anomalous nodes.
• Figure 3: The stages of constructing anomalous subgraphs. OCR-APT starts from anomalous nodes, connects them by direct connections, gets all one-hop neighbor nodes, and keeps only neighbors that lead to other anomalous nodes.
• Figure 4: Architecture of the LLM-based attack investigator. The system serializes anomalous subgraphs into log documents, indexes them in a vector store, and uses an LLM to generate attack reports. It identifies key IOCs, enriches reports with context subgraphs, and produces a comprehensive report for analysts. The visualized reports are simplified versions of the recovered report from host 501 in the DARPA OpTC dataset.
• Figure 5: Schema of provenance graphs for the CADETS host.