Advanced Persistent Threats (APTs) have become increasingly sophisticated and covert, necessitating the acquisition of an overall view of the rapidly evolving cyber threat landscape by security defenders. However, integrating threat intelligence from diverse sources poses significant challenges due to limited labeled data and noise interference. To address the requirement for the early detection of APT attacks, this paper introduces a lightweight framework named Warning-Graph, based on threat intelligence modeling. Warning-Graph leverages a limited set of IoCs to infer the type of ongoing APT attack. Initially, attack-related infrastructure nodes are modeled as a heterogeneous information network. Subsequently, heterogeneous graph contrastive learning is employed for pre-training. Two asymmetric graph encoders are constructed to obtain node embeddings without the need to generate negative samples or labeled data. In addition, a loss function based on the information bottleneck is specifically employed to reduce the noise in the original graph. In downstream tasks, multiclass classifiers are trained using embedding representations with fewer labeled samples. Experimental results demonstrate that the proposed framework achieves a 3- to 5-point increase in identification performance for APT attack types compared to baselines, while utilizing fewer labeled samples.

APT attacks are becoming increasingly complex and stealthy. To effectively counter APT attacks, modelling threat intelligence data based on graphs, identifying Indicators of Compromise (IOC) nodes, and providing early warnings have become new research hotspots. However, the problem of node category imbalance in such graph datasets restricts the identification capabilities of these methods. Therefore, this paper proposes a supervised graph data augmentation method. In the training phase, graph disentangled representation learning is utilized to perform feature embedding for minority class nodes, effectively alleviating the sparsity problem faced by traditional methods and effectively integrating neighbourhood information of minority class nodes at a higher semantic level. Additionally, two loss functions designed based on link prediction and prototype constraints enhance node type consistency and semantic consistency, respectively. Experimental results on the APT and PDNS datasets demonstrate that the proposed method outperforms other baseline models in identification performance; even in highly imbalanced scenarios, it surpasses the second-best model.