APTMimic: Automated Attack Simulation for Dynamic APT Attack Sample Generation

Abstract

Advanced Persistent Threat (APT) attacks cause major losses across critical industries. Existing machine-learning detectors, restricted by the scarcity of provenance-level samples, rely on benign-behavior anomaly detection and suffer from high false-alarm rates and weak interpretability. We propose APTMimic, an automated APT-sample generation system for supervised provenance-graph research in authorized, isolated laboratory environments. APTMimic defines atomic attack behaviors and assembles a multi-source library; extracts attack-technique chains from CTI reports using a customized prompt framework with an LLM; organizes candidate chains via cost- and novelty-aware optimization; and generates attack code, simulates execution, and converts logs into provenance-graph samples. Experiments show APTMimic effectively organizes atomic behaviors, extracts TTP sequences with high precision, and executes attack tasks reliably. The resulting samples expose clear weaknesses in four representative detection models, providing stress-testing resources for provenance-graph-based APT detection.