This invention provides an APT
attack detection method, apparatus, and electronic device based on graph attention learning, comprising: acquiring the operation log of the
system to be monitored, and forming a
time series graph of the
system to be monitored based on the operation log, the
time series graph including multiple nodes and
time series graph edges connecting the nodes; inputting the time series graph into a pre-trained
edge type prediction model to obtain the time series
graph edge types output by the
edge type prediction model, wherein the
edge type prediction model includes an
encoder based on a time series graph neural network and a decoder based on a graph
attention network; based on the time series
graph edge types and the true edge types, obtaining the
reconstruction error of the actual time series graph edges corresponding to the time series
graph edge types through a cross-entropy
loss function, wherein the true edge type is the edge type of the observed actual time series graph edges; and determining whether the
system to be monitored is subjected to an APT
attack based on the
reconstruction error. This achieves accurate and efficient APT
attack detection without relying on known attack features.