An APT detection scheme based on a hierarchical co-attention transformer

Advanced Persistent Threat (APT) poses a serious security challenge because of their stealthy, multi-stage attack lifecycle. These threats can persist undetected for months, causing severe financial and reputational damage. Moreover, the growing volume and diversity of network traffic amplify the difficulty of real-time identification. Existing APT detectors-ranging from recurrent and convolutional neural networks to single-stage Transformers-often fail to jointly capture local features and global dependencies efficiently. In this paper, our model introduces a Hierarchical Local-Global Co-Attention (HLCDA) for robust and efficient APT detection. HLCDA comprises three encoders. Firstly, an xLSTM block with a Time-Scale Gate (TSG) for multi-scale temporal dependencies. Secondly, a Multi-Scale Depthwise Separable CNN (MS-DS-CNN) for short-range spatial features. Thirdly, a RoPE-enhanced Transformer (RoPET) for global contextual modeling. A key advancement is a hierarchical co-attention mechanism that enables bidirectional interaction between the TSG-xLSTM and MS-DS-CNN streams prior to fusion. The model then fuses these representations through a Dynamic Multi-Head Feature Fusion (DMFF) module. Evaluated on three real-world benchmarks (DAPT 2020, UNSW-NB15, and CIC-IDS2018), HLCDA achieved 94.60% accuracy and a 95.72% F1 score on DAPT 2020, 93.12% accuracy and 93.00% F1 on UNSW-NB15, and 92.84% accuracy and 92.54% F1 on CIC-IDS2018, while maintaining sub-millisecond inference latency, demonstrating strong capability to distinguish sophisticated APT campaigns from benign traffic. This advancement offers organizations a practical and scalable defense, strengthening resilience against evolving APT threats.