Advanced Persistent Threats (APTs) exploit temporally distributed and causally structured behaviors in system provenance graphs, enabling multi-stage attack campaigns that challenge stable behavioral modeling. Existing graph-based detection methods often conflate benign but rare activities with malicious behavior, leading to excessive false positives and unstable performance under distributional shifts. We propose the Elasticity-Aware Temporal Heterogeneous Graph Neural Network (EA-THGN). This node-level detection framework reframes detection from identifying anomalous representations to identifying epistemic instability, i.e., nodes that resist confident classification across multi-stage learning. EA-THGN employs self-paced training with hard-negative filtering to generate node-specific learning trajectories that encode how confidence, entropy, and prediction correctness evolve across stages rather than relying on single-stage evidence alone. To capture behavioral heterogeneity, EA-THGN introduces three node-adaptive mechanisms: Elastic Hop Aggregation, Elastic Temporal Softmax, and Elastic Attention Width. Ablation results show that structural and temporal adaptivity yield the largest gains, whereas attentional adaptivity is most effective when layered on top. Experiments on three DARPA TC E3 provenance datasets demonstrate state-of-the-art performance, achieving F1-scores up to 0.9998 and reducing false positives by up to two orders of magnitude. Under independent per-dataset evaluation, the analysis confirms that attention-based aggregation and trajectory-derived features are critical for robust and interpretable temporal graph learning.

We tackle the problem of automated exploit generation for web applications. In this regard, we present an approach that significantly improves the state-of-art in web injection vulnerability identification and exploit generation. Our approach for exploit generation tackles various challenges associated with typical web application characteristics: their multi-module nature, interposed user input, and multi-tier architectures using a database backend. Our approach develops precise models of application workflows, database schemas, and native functions to achieve high quality exploit generation. We implemented our approach in a tool called Chainsaw. Chainsaw was used to analyze 9 open source applications and generated over 199 first- and second-order injection exploits combined, significantly outperforming several related approaches.