Abstract:Advanced Persistent Threats (APTs) are continuously evolving, leveraging their stealthiness and persistence to put increasing pressure on current provenance-based Intrusion Detection Systems (IDS). This evolution exposes several critical issues: (1) The dense interaction between malicious and benign nodes within provenance graphs introduces neighbor noise, hindering effective detection; (2) The complex prediction mechanisms of existing APTs detection models lead to the insufficient utilization of prior knowledge embedded in the data; (3) The high computational cost makes detection impractical. To address these challenges, we propose Winemaking, a lightweight threat detection system built on a knowledge distillation framework, capable of node-level detection within audit log provenance graphs. Specifically, Winemaking applies graph Laplacian regularization to reduce neighbor noise, obtaining smoothed and denoised graph signals. Subsequently, Winemaking employs a teacher model based on GNNs to extract knowledge, which is then distilled into a lightweight student model. The student model is designed as a trainable combination of a feature transformation module and a personalized PageRank random walk label propagation module, with the former capturing feature knowledge and the latter learning label and structural knowledge. After distillation, the student model benefits from the knowledge of the teacher model to perform precise threat detection. We evaluate Winemaking through extensive experiments on three public datasets and compare its performance against several state-of-the-art IDS solutions. The results demonstrate that Winemaking achieves outstanding detection accuracy across all scenarios and the detection time is 1.4 to 5.2 times faster than the current state-of-the-art methods.

Construction and Application of Knowledge Graph for Risk Identification Methods of Counterfeit Cigarettes and Wine

Multimodal knowledge graph construction for risk identification in water diversion projects

A Heterogeneous Graph-based Fraudulent Community Detection System

Distilling Meta Knowledge on Heterogeneous Graph for Illicit Drug Trafficker Detection on Social Media

Research on Key Technologies of Wine Quality and Safety System Using ANN

A Framework for Institutional Risk Identification using Knowledge Graphs and Automated News Profiling

Transfer Learning on Knowledge Graph Construction: A Case Study of Investigating Gas-Mining Risk Report

Knowledge Graph Construction for Payment Data Risk Control

A Risk Prediction Model for Network Security Using Knowledge Graph

HKTGNN: Hierarchical Knowledge Transferable Graph Neural Network-based Supply Chain Risk Assessment

A Knowledge Graph Based Framework in Relationship Modelling and Real-time Monitoring of Market Participants

Eriskcom: an E-Commerce Risky Community Detection Platform

Risk identification and management through knowledge Association: A financial event evolution knowledge graph approach

Winemaking: Extracting Essential Insights for Efficient Threat Detection in Audit Logs

Construction and Application of Knowledge Graph for Building Fire

Banking System Incidents Analysis Using Knowledge Graph

Research on construction method of knowledge graph in the civil aviation security field

Constructing a Coal Mine Safety Knowledge Graph to Promote the Association and Reuse of Risk Management Empirical Knowledge

Construction and application of COVID-19 infectors activity information knowledge graph

A Subgraph-Based Knowledge Reasoning Method for Collective Fraud Detection in E-commerce.

Social network analysis for personalized characterization and risk assessment of alcohol use disorders in adolescents using semantic technologies