Clark: a Transferable APT Detection Framework via Self-supervised Contrastive Learning

Advanced Persistent Threats (APT) are stealthy, long-lasting cyberattacks that exfiltrate sensitive information or compromise infrastructure, posing challenges to traditional security defenses. Recently, provenance graphs constructed from system audit logs have emerged as a powerful tool for capturing complex system behaviors and facilitating APT detection. However, existing provenance-based intrusion detection systems still struggle with three key challenges: the scarcity of labeled data, limited robustness to novel attacks, and poor adaptability to distribution shifts across environments. To address these limitations, we propose Clark, a self-supervised contrastive learning framework that integrates Graph Neural Networks (GNNs) with Large Language Models (LLMs) for fine-grained, node-level APT detection. Clark is designed to achieve high robustness, cross-domain generalization, and both zero-shot and few-shot transfer capabilities. Specifically, we construct a graph-text multimodal dataset and employ invariance learning to enhance the model’s generalizability across unseen domains. Additionally, we introduce a novel graph prompt tuning technique to support efficient few-shot adaptation, mitigating catastrophic forgetting and reducing training costs. Extensive experiments on public datasets demonstrate that Clark outperforms existing methods in both zero-shot and few-shot scenarios, showcasing its effectiveness and transferability for real-world APT detection.