New Machine Learning Framework Improves APT Detection Across Different Operating Systems Without Target Data
A new machine learning framework enables detection of Advanced Persistent Threats (APTs) across different operating systems using only source-domain training data, requiring no labeled examples from the target platform. The approach combines natural-language process descriptions, pretrained language model embeddings, and Optimal Transport-based anomaly scoring to rank suspicious processes on unseen platforms. This matters because cross-platform APT detection has been a significant practical barrier for cybersecurity defenders who rarely have labeled attack data on every system they must protect.
Researchers have introduced a source-only transfer learning framework for detecting Advanced Persistent Threats across heterogeneous operating systems, including Linux, Windows, BSD, and Android, without requiring any labeled data from the target platform. The system converts process-level provenance traces into structured natural-language descriptions, encodes them with pretrained language models, and builds a reference model of normal behavior from the source domain alone. Anomaly scoring draws on three complementary signals: semantic deviation from source-normal prototypes, structural deviation via graph autoencoding, and geometric deviation measured through Optimal Transport (OT). The central contribution is an OT-based barycentric anomaly score that projects target embeddings onto the source-normal manifold and measures residual transport mismatch, with additional variants that incorporate entropy weighting, angular drift, and sparse-support density awareness. Evaluation on DARPA Transparent Computing datasets across twelve cross-OS transfer pairs and two APT scenarios showed improvements in ROC-AUC and normalized Discounted Cumulative Gain (nDCG) over existing source-only baselines. The work addresses a practical deployment gap where security teams must monitor diverse infrastructure without the luxury of collecting and labeling attack traces on every target system.
What's missing
The paper is a preprint and has not yet undergone peer review. Key open questions include how the framework performs against APT scenarios not represented in the DARPA Transparent Computing dataset, whether the natural-language abstraction of process behavior introduces information loss that could affect detection of novel attack variants, and computational overhead and real-time feasibility in production environments.
What different sources said
- arXiv cs.LGCenter
A Source Domain is All You Need: Source-Only Cross-OS Transfer Learning for APT Anomaly Detection via Semantic Alignment and Optimal Transport
Related
Gut Bacteria Enzyme Found to Break Down Heat-Processed Food Compounds, Producing Novel Biogenic Amines
Researchers have discovered that an enzyme in common gut bacteria can degrade N-epsilon-carboxymethyllysine (CML), a compound formed during thermal food processing, producing previously unknown biogenic amines. The enzyme, ornithine decarboxylase SpeC from enterobacteria, acts on CML and related modified lysine derivatives through a low-level 'underground' catalytic activity. This finding suggests a previously unrecognized communication axis between thermally processed dietary compounds and gut microbial physiology, with potential implications for host health.
Full-Length Gene Sequencing Reveals Two Distinct Bacterial Communities in Black-Legged Ticks Expanding Into Canada
Researchers used Oxford Nanopore full-length 16S rRNA gene sequencing to characterize the microbiome of Ixodes scapularis black-legged ticks collected in Nova Scotia, Canada, distinguishing between tick-adapted bacteria and environmentally acquired bacteria. The study comes as I. scapularis — the primary vector of Lyme disease — is rapidly expanding northward into Canada due to climate change. The findings suggest that environmentally derived bacteria in tick microbiomes are not mere contamination, which has implications for how tick microbiome data is collected and interpreted across surveillance studies.
Study Identifies Metabolic Link Between Cell Envelope Stress and Biofilm Formation in Bacteria
Researchers have discovered that the metabolite acetyl-CoA directly inhibits enzymes that degrade the bacterial signaling molecule c-di-GMP, connecting cell envelope biosynthesis stress to biofilm formation in Pseudomonas aeruginosa. The study found that sub-inhibitory concentrations of antibiotics targeting early peptidoglycan biosynthesis — but not other antibiotic classes — elevate c-di-GMP levels by reducing phosphodiesterase activity, with acetyl-CoA competing for the enzyme active site. Because the relevant enzyme domain is broadly conserved across bacterial species, this checkpoint mechanism may be widespread and could have implications for understanding antibiotic-induced biofilm responses.