Incorporating Gradients to Rules: Towards Lightweight, Adaptive Provenance-based Intrusion Detection

arXiv:2404.14720v1 Announce Type: new
Abstract: As cyber-attacks become increasingly sophisticated and stealthy, it becomes more imperative and challenging to detect intrusion from normal behaviors. Through fine-grained causality analysis, provenance-based intrusion detection systems (PIDS) demonstrated a promising capacity to distinguish benign and malicious behaviors, attracting widespread attention from both industry and academia. Among diverse approaches, rule-based PIDS stands out due to its lightweight overhead, real-time capabilities, and explainability. However, existing rule-based systems suffer low detection accuracy, especially the high false alarms, …

analysis arxiv attacks attention cs.cr cyber detect detection industry intrusion intrusion detection intrusion detection systems malicious normal provenance rules systems