PROV-LLM: Advanced Persistent Threat Detection Based on Process Behavior Subgraphs Using Large Language Models

Advanced Persistent Threats (APTs) pose significant cybersecurity challenges through stealthy, multi-stage attacks that leverage zero-day exploits and evasive tactics. While provenance graph-based methods show promise for APT detection, existing approaches face three critical limitations: (i) inappropriate granularity levels, (ii) insufficient critical context, and (iii) lack of interpretable output. To address these challenges, we propose Prov-LLM, a novel LLM-enhanced detection system that leverages process-centric behavioral subgraphs. Our approach first decomposes large provenance graphs into process-centered graphs, enriching them with key attributes such as process names, execution paths, and command-line arguments. Prov-LLM then utilizes a Retrieval-Augmented Generation (RAG) framework to establish a baseline of benign behavior, enabling LLMs to perform context-aware anomaly detection via semantic reasoning. Finally, the system reconstructs anomalous process behavior subgraphs and generates human-readable explanations of attacks, offering security analysts intuitive insights for investigation. We evaluate Prov-LLM on three DARPA OPTC attack datasets: Plain PowerShell Empire, Custom PowerShell Empire, and Malicious Upgrade. Results demonstrate that Prov-LLM outperforms state-of-the-art methods in accuracy, precision, and recall. Notably, the synergy between process behavior subgraphs and LLMs significantly reduces analysts’ workload during attack investigations.