Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models

Advanced Persistent Threats (APTs) are notoriously difficult to detect because they unfold over long time horizons and blend into benign system activity. Existing machine learning approaches for log analysis often rely on heavy, manual feature engineering and complex preprocessing pipelines, which are costly to maintain and lack portability across different environments. The authors investigate whether a more flexible, context-aware approach using pre-trained language models can achieve robust detection without such intensive curation.

The authors propose CAPTAIN (Context-Augmented Perplexity-based Threat Activity log detectIoN). Unlike previous methods that evaluate log entries in isolation, CAPTAIN uses a two-stage Q-Former module to bridge an encoder and a decoder-only language model. This allows the system to inject compact, learned context tokens representing recent log history into the language model. By calculating the perplexity of the current log entry conditioned on this history, the model identifies anomalies where the observed behavior deviates from the learned 'normal' patterns. Finally, the authors apply a Wiener-based smoothing filter to the resulting perplexity time series to improve detection stability and reduce noise.

Through a replication study of the existing AIRTAG baseline, the authors identify significant evaluation artifacts, such as cross-split keyword leakage and the unintentional use of ground-truth labels in post-processing filters. After correcting for these issues, they demonstrate that CAPTAIN performs competitively with strong baselines while requiring significantly less domain-specific preprocessing. The use of soft prompting via the Q-Former bridge effectively captures temporal dependencies, and the application of smoothing filters consistently improves the detector's robustness against transient noise in log data.