LogShield: A Transformer-based APT Detection System Leveraging Self-Attention. (arXiv:2311.05733v1 [cs.CR])

Cyber attacks are often identified using system and network logs. There have
been significant prior works that utilize provenance graphs and ML techniques
to detect attacks, specifically advanced persistent threats, which are very
difficult to detect. Lately, there have been studies where transformer-based
language models are being used to detect various types of attacks from system
logs. However, no such attempts have been made in the case of APTs. In
addition, existing state-of-the-art techniques that use system provenance
graphs, lack …

advanced advanced persistent threats apt attacks attention cyber cyber attacks detect detection graphs language language models logs network persistent persistent threats provenance studies system techniques threats