  Advance Persistent Threats (APTs), adopted by most delicate attackers, are
becoming increasing common and pose great threat to various enterprises and
institutions. Data provenance analysis on provenance graphs has emerged as a
common approach in APT detection. However, previous works have exhibited
several shortcomings: (1) requiring attack-containing data and a priori
knowledge of APTs, (2) failing in extracting the rich contextual information
buried within provenance graphs and (3) becoming impracticable due to their
prohibitive computation overhead and memory consumption.
  In this paper, we introduce MAGIC, a novel and flexible self-supervised APT
detection approach capable of performing multi-granularity detection under
different level of supervision. MAGIC leverages masked graph representation
learning to model benign system entities and behaviors, performing efficient
deep feature extraction and structure abstraction on provenance graphs. By
ferreting out anomalous system behaviors via outlier detection methods, MAGIC
is able to perform both system entity level and batched log level APT
detection. MAGIC is specially designed to handle concept drift with a model
adaption mechanism and successfully applies to universal conditions and
detection scenarios. We evaluate MAGIC on three widely-used datasets, including
both real-world and simulated attacks. Evaluation results indicate that MAGIC
achieves promising detection results in all scenarios and shows enormous
advantage over state-of-the-art APT detection approaches in performance
overhead.
