# TGCM: Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequences

arXiv: https://arxiv.org/abs/2606.18651 · HTML: https://mlsanity.com/paper/2606.18651/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Discrete and text diffusion, one of 14 directions in Diffusion models.
- Builds on 29 of its 74 references that are in the map.
- First posted on arXiv 17 Jun 2026.

## Placed in

- Diffusion models / [Discrete and text diffusion](https://mlsanity.com/diffusion/discrete-and-text-diffusion/)

## Builds on (most cited first, 29 of 29)

- [Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2006.11239/) (2020)
- [Diffusion Models Beat GANs on Image Synthesis](https://mlsanity.com/paper/2105.05233/) (2021)
- [Layer Normalization](https://mlsanity.com/paper/1607.06450/) (2016)
- [Improved Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2102.09672/) (2021)
- [Consistency Models](https://mlsanity.com/paper/2303.01469/) (2023)
- [Structured Denoising Diffusion Models in Discrete State-Spaces](https://mlsanity.com/paper/2107.03006/) (2021)
- [Diffusion-LM Improves Controllable Text Generation](https://mlsanity.com/paper/2205.14217/) (2022)
- [BERTopic: Neural topic modeling with a class-based TF-IDF procedure](https://mlsanity.com/paper/2203.05794/) (2022)
- [Attention is All You Need in Speech Separation](https://mlsanity.com/paper/2010.13154/) (2020)
- [LogBERT: Log Anomaly Detection via BERT](https://mlsanity.com/paper/2103.04475/) (2021)
- [UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats](https://mlsanity.com/paper/2001.01525/) (2020)
- [HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flows](https://mlsanity.com/paper/1810.01594/) (2018)
- [MossFormer2: Combining Transformer and RNN-Free Recurrent Network for Enhanced Time-Domain Monaural Speech Separation](https://mlsanity.com/paper/2312.11825/) (2023)
- [FASTopic: Pretrained Transformer is a Fast, Adaptive, Stable, and Transferable Topic Model](https://mlsanity.com/paper/2405.17978/) (2024)
- [AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports](https://mlsanity.com/paper/2111.07093/) (2021)
- [Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance](https://mlsanity.com/paper/2308.05034/) (2023)
- [SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data](https://mlsanity.com/paper/1801.02062/) (2018)
- [Discovering Object-Centric Petri Nets](https://mlsanity.com/paper/2010.02047/) (2020)
- [POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting](https://mlsanity.com/paper/1910.00056/) (2019)
- [Deep attractor network for single-microphone speaker separation](https://mlsanity.com/paper/1611.08930/) (2016)
- [MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning](https://mlsanity.com/paper/2310.09831/) (2023)
- [NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation](https://mlsanity.com/paper/2311.02331/) (2023)
- [Mining Local Process Models](https://mlsanity.com/paper/1606.06066/) (2016)
- [TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learning](https://mlsanity.com/paper/2402.15147/) (2024)
- [ProvG-Searcher: A Graph Representation Learning Approach for Efficient Provenance Graph Search](https://mlsanity.com/paper/2309.03647/) (2023)
- [Event-Case Correlation for Process Mining using Probabilistic Optimization](https://mlsanity.com/paper/2206.10009/) (2022)
- [Trace your sources in large-scale data: one ring to find them all](https://mlsanity.com/paper/1803.08882/) (2018)
- [Resolving Uncertain Case Identifiers in Interaction Logs: A User Study](https://mlsanity.com/paper/2212.00009/) (2022)
- [A Cascade Approach for APT Campaign Attribution in System Event Logs: Technique Hunting and Subgraph Matching](https://mlsanity.com/paper/2410.22602/) (2024)

## Abstract (arXiv)

Multiple Advanced Persistent Threat (APT) campaigns may execute concurrently, producing audit logs whose events are interleaved without explicit campaign boundaries. We formulate this setting as Unknown-K Interleaved Sequence Demixing (UKISD): recovering coherent campaign episodes when the number of concurrent campaigns is unknown. Each episode is represented as a sequence of MITRE ATT&CK technique occurrences, and demixing is cast as occurrence-level assignment with sequence reconstruction. Existing methods often assume single-campaign observations or rely on local heuristics, limiting robustness to severe interleaving, repeated techniques, abstraction noise, and unknown mixture cardinality. We propose Topic-Guided Consistency Modeling (TGCM), a consistency-inspired one-step framework for UKISD. TGCM maps an interleaved technique sequence to campaign episodes, jointly performing occurrence assignment and sequence reconstruction in one forward pass. It combines topic guidance from ATT&CK narratives with an embedding-space self-consistency objective to improve semantic coherence and retain efficient inference. We evaluate TGCM on synthetic mixtures, mixed benchmarks, DARPA engagement traces, and CAPTure, an end-to-end benchmark containing 200 scenarios, 855 million audit events, and 25 ATT&CK-aligned attack profiles in single-host and multi-host settings. TGCM improves occurrence-level assignment under heavy interleaving, repeated technique reuse, symbolic extraction errors, and budgeted unknown-K inference. It also generalizes to unseen benchmarks without retraining and remains effective with practical ATT&CK extraction pipelines. These results establish TGCM as a practical post-abstraction framework for reasoning about concurrent APT campaigns. Code and artifacts are available at https://irish-kw.github.io/TGCM_Website/.