Adaptive Graph Neural Network (AGNN) for Multi-Stage APT Detection

Advanced Persistent Threats (APTs) present a major challenge to cyber defence, operating through stealthy, multi-stage campaigns that exploit dependencies across networked systems, requiring reasoning over evolving activity rather than isolated events. We propose an Adaptive Graph Neural Network (AGNN) for multi-stage APT detection, which represents network telemetry as a continuously evolving graph with semantic edge features. Our AGNN learns time-aware representations of network entities, capturing both relational structure and temporal dynamics. By modelling higher-order dependencies, the AGNN uncovers correlations between attack stages, such as reconnaissance, lateral movement, and data exfiltration, that are often missed by current rule-based approaches. In our proposal, enterprise and critical infrastructure environments are modelled as dynamic graphs, where nodes represent hosts and edges capture interactions over time. The model's temporal graph learning updates node embeddings to emphasise recent, contextually relevant behaviour, enabling joint reasoning over topology and time. Instead of producing large volumes of alerts, the AGNN highlights anomalous subgraphs. Thereby, our approach allows analysts to inspect coherent attack patterns and reduce alert fatigue. Unlike conventional security information and event management (SIEM) analytics based on static correlation rules, our graph-based approach reveals temporally separated dependencies and propagation paths that evade baseline detection. We trained the AGNN on the Unraveled dataset and evaluated both in-domain and via transfer learning on a Critical Infrastructure Simulation Tool (CIST) we developed, which was inspired by the NATO Locked Shields exercise. Results, such as precision of 0.991 and a recall of 0.988, show strong detection across all APT stages, early identification of compromise indicators, and effective generalisation to unseen network topologies.