TC-GAT: Temporal Causal Graph Attention for Interpretable APT Detection

In the present day, the concept of APT or Advanced Persistent Threat usually refers to the ongoing security attacks and data problem within a Linux based operation system. Officially driven hacking activities are normally concerned with multiple players who can include the attackers, the safeguarding organization, and neutral players who may support or impede these cyber assaults. However, operational logs are extremely out of balance, with a few malicious events embedded in a huge amount of benign activity, and alerts need to be interpretable to aid analyst triage. Conventional feature-based classifiers and unsupervised anomaly detectors are generally not capable of capturing cross-entity dependencies and multi-stage attack transitions, whereas conventional graph models generally do not make full use of the temporal continuity and also do not explicitly focus on the relations that are causally important. To solve these problems, this paper proposes TC-GAT, a temporal–causal graph attention framework that generates time-ordered heterogeneous graphs from multi-source telemetry and type-aware attention with GRU-based temporal aggregation, while introducing causal weighting to handle the attack–relevant dependencies. Experiments are run on the APT Evaluation Dataset for Linux 2024 with over 50 million events sampled from syslog, auth.log, file-system audit, and network PCAP and 10M benign and 5K malicious events in 5 attack stages, in the form of 1 hour snapshots and 50% overlap. TC-GAT achieves a precision of 0.92, recall of 0.94, F1-score of 0.93, and AUC of 0.98, which is better than a GCN baseline (F1-score 0.87, AUC 0.93), and ablation results show the contribution of causal weighting, temporal aggregation, and heterogeneous attention with F1-scores of 0.88, 0.86, and 0.84 when each one is removed. The model is compact (0.28M parameters) and enables close to real-time inference (50 ms to infer one snapshot) with accurate detection and short evidence paths that correspond to attack progress.