Multi-Layer APT Detection Framework With OSINT Enrichment

Abstract

Advanced Persistent Threats (APTs) are multi-stage campaigns whose detection requires correlating signals across endpoint, network, and external intelligence sources. Existing provenance-based detectors rarely incorporate external threat intelligence, and existing Open Source Intelligence (OSINT) pipelines rely almost exclusively on IP and domain reputation, which is inapplicable to private Industrial Internet of Things (IIoT) networks. This paper presents an integration framework that combines established graph-based detectors with an adaptive OSINT strategy and a transparent hypothesis-scoring rubric. The framework is organized in four layers: (i) detection using existing graph models (MAGIC for provenance, a Graph Isomorphism Network with Edge Features (GINE) for IIoT traffic), (ii) ground-truth validation, (iii) adaptive OSINT enrichment that uses IP-based queries for public networks and tool-based OSINT for private networks, and (iv) an eight-criterion (C1–C8) hypothesis-scoring rubric that operates in a dual ground-truth / OSINT-only mode. The contribution of this work is the integration architecture, the tool-based OSINT mechanism, the formalized scoring rubric, and a per-layer ablation study — not a new detector. We evaluate on five benchmarks across three domains: DARPA TC E3 (CADETS, THEIA, TRACE), synthetic batch graphs (StreamSpot, Wget), MAWI backbone traces, and CICAPT-IIoT. Detection AUC ranges from 0.998 on enterprise provenance to 0.939 on highly imbalanced IIoT traffic (AUPRC 0.654, reflecting a 0.01% malicious-node rate). On datasets with documented APT campaigns, the dual-mode rubric reaches 75–100% inter-mode agreement, and the ablation study shows that the full four-layer configuration is the only one that attains this agreement simultaneously under both ground-truth and OSINT-only scoring. We report all limitations of the evaluation, including the controlled nature of the OSINT validation set (n=80 IoCs; 100% accuracy under verified ground truth and 52.5% under uncontrolled conditions, revealing IoC-type-specific threshold sensitivity), the circular nature of APT29 attribution on an APT29-emulated dataset, and the absence of quantitative comparison against retrained baselines.