Abstract:Recent research in both academia and industry has validated the effectiveness of provenance graph-based detection for advanced cyber attack detection and investigation. However, analyzing large-scale provenance graphs often results in substantial overhead. To improve performance, existing detection systems implement various optimization strategies. Yet, as several recent studies suggest, these strategies could lose necessary context information and be vulnerable to evasions. Designing a detection system that is efficient and robust against adversarial attacks is an open problem. We introduce Marlin, which approaches cyber attack detection through real-time provenance graph <a class="link-external link-http" href="http://alignment.By" rel="external noopener nofollow">this http URL</a> leveraging query graphs embedded with attack knowledge, Marlin can efficiently identify entities and events within provenance graphs, embedding targeted analysis and significantly narrowing the search space. Moreover, we incorporate our graph alignment algorithm into a tag propagation-based schema to eliminate the need for storing and reprocessing raw logs. This design significantly reduces in-memory storage requirements and minimizes data processing overhead. As a result, it enables real-time graph alignment while preserving essential context information, thereby enhancing the robustness of cyber attack detection. Moreover, Marlin allows analysts to customize attack query graphs flexibly to detect extended attacks and provide interpretable detection results. We conduct experimental evaluations on two large-scale public datasets containing 257.42 GB of logs and 12 query graphs of varying sizes, covering multiple attack techniques and scenarios. The results show that Marlin can process 137K events per second while accurately identifying 120 subgraphs with 31 confirmed attacks, along with only 1 false positive, demonstrating its efficiency and accuracy in handling massive data.

AttackMiner: A Graph Neural Network Based Approach for Attack Detection from Audit Logs

Devil in Disguise: Breaching Graph Neural Networks Privacy through Infiltration

ASA: Adversary Situation Awareness Via Heterogeneous Graph Convolutional Networks.

AMiner: A Modular Log Data Analysis Pipeline for Anomaly-based Intrusion Detection

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

A Hierarchical Approach for Advanced Persistent Threat Detection with Attention-Based Graph Neural Networks

Attack Graph Analysis for Network Anti-Forensics.

Detect Advanced Persistent Threat In Graph-Level Using Competitive AutoEncoder.

APT-KGL: an Intelligent APT Detection System Based on Threat Knowledge and Heterogeneous Provenance Graph Learning

GraphAttacker: A General Multi-Task GraphAttack Framework

Marlin: Knowledge-Driven Analysis of Provenance Graphs for Efficient and Robust Detection of Cyber Attacks

Detecting APT-Exploited Processes through Semantic Fusion and Interaction Prediction

ATLAS: A Sequence-based Learning Approach for Attack Investigation

MEGR-APT: A Memory-Efficient APT Hunting System Based on Attack Representation Learning

Log2Graph: A graph convolution neural network based method for insider threat detection

Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logs

threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learning

Unveiling the potential of Graph Neural Networks for robust Intrusion Detection

Log Analysis For Network Attack Detection Using Deep Learning Models

A dideazatetrahydrofolate analogue lacking a chiral center at C-6, N-[4-[2-(2-amino-3,4-dihydro-4-oxo-7H-pyrrolo[2,3-d]pyrimidin-5- yl)ethyl]benzoyl]-L-glutamic acid, is an inhibitor of thymidylate synthase.

Detecting Complex Multi-step Attacks with Explainable Graph Neural Network