Research map / Graph learning / Graph self-supervised learning
The Case for Learned Provenance-based System Behavior Baseline
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a lightweight learned baseline that regresses frequency-based regular scores of provenance-graph events (with OOV-aware adaptive embeddings) and plugs it into tag-propagation for real-time anomaly path mining in PIDSes.
Problem
Provenance-based intrusion detection struggles with large, dynamic provenance graphs: storage and compute overhead, out-of-vocabulary entities from new system activity, normality shift over time, and the cost of GNN-based models for real-time detection.
Approach
Decouple provenance graphs into frequency-scored events, embed events with OOV-aware adaptive encodings (zero vectors for unseen words, weighted file-path embeddings, one-hot categories), train a lightweight MLP/LSTM/CNN regressor to predict regular scores as a learned baseline, and use its outputs as initial tags in tag-propagation for streaming anomaly path detection.
Key results
- On E3-CADETS, the FastText (OOV-as-zero-vector) variant with tag propagation reports path-level F1 of 0.9963 (precision 0.9927, recall 1.0).
- In node-level comparison on E3-CADETS, the method reports F1 0.4778 (32 TP, 69 FP) versus Kairos, ProvDetector and NoDoze with F1 0.0003, 0.3636 and 0.0885 respectively.
- Non-OOV-handling encoders such as TinyBERT and plain Doc2Vec perform poorly on malicious-event accuracy (Accuracy2 of 0.1143 and 0.2905).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the learned baseline with tag propagation instead of Nodoze | Provenance-based intrusion detection · E3-CADETS | F1 score: 0.0885 -> 0.4778 | Helped |
| Use the learned baseline with tag propagation instead of ProvDetector | Provenance-based intrusion detection · E3-CADETS | F1 score: 0.3636 -> 0.4778 | Helped |
| Use the learned baseline with tag propagation instead of Nodoze | Provenance-based intrusion detection · E3-THEIA | F1 score: 0.1791 -> 0.3200 | Helped |
| Use the learned baseline with tag propagation instead of ProvDetector | Provenance-based intrusion detection · E3-TRACE | F1 score: 0.1493 -> 0.0229 | Hurt |
| Map OOV words to zero vectors (ablation) | FastText event encoding · E3-CADETS anomaly path mining | F1 score: 0.0694±0.0437 -> 0.9963±0.0026 | Helped |
| Use FastText* instead of Word2Vec* (ablation) | Learned baseline and tag-propagation detector · E3-CADETS anomaly path mining | F1 score: 0.7809±0.0865 -> 0.9963±0.0026 | Helped |
| Use FastText* instead of Doc2Vec* (ablation) | Learned baseline and tag-propagation detector · E3-CADETS anomaly path mining | F1 score: 0.8568±0.1050 -> 0.9963±0.0026 | Helped |
| Add file-path weight encoding (ablation) | FastText* event encoding · E3-CADETS anomaly path mining | F1 score: 0.9963±0.0026 -> 0.5124±0.0350 | Hurt |
| Add one-hot entity and relationship encoding (ablation) | FastText* event encoding · E3-CADETS anomaly path mining | F1 score: 0.9963±0.0026 -> 0.6275±0.2331 | Hurt |
| Use FastText* instead of Doc2Vec without explicit OOV handling (ablation) | Learned baseline and tag-propagation detector · E3-CADETS anomaly path mining | F1 score: 0.0867±0.0657 -> 0.9963±0.0026 | Helped |
| Use FastText* instead of TinyBERT (ablation) | Learned baseline and tag-propagation detector · E3-CADETS anomaly path mining | F1 score: 0.0785±0.0871 -> 0.9963±0.0026 | Helped |
Surprising findings
- TinyBERT, a Transformer encoder, performs worse than shallow FastText/Word2Vec for event embedding, and its encoding is orders of magnitude slower.
- The one-hot and weighted-path variants reduce performance relative to plain FastText with zero-vector OOV handling, indicating OOV handling matters more than embedding sophistication.
Limitations
- Single-event regular scores rely on frequency statistics, so adaptation to new benign behaviour depends on the baseline being refit.
- Comparison with prior systems uses node-level metrics because detection granularities differ, and the method has many false positives on E3-TRACE and E3-CADETS (69 and 1448 FPs).
Experimental setup
Datasets: DARPA Transparent Computing E3-CADETS
Benchmarks: DARPA TC E3-CADETS DARPA TC E3-THEIA DARPA TC E3-TRACE
Metrics: accuracy path-level precision recall F1 score node-level TP/FN/FP encoding time training time
Baselines: Nodoze ProvDetector Flash Kairos Word2Vec Doc2Vec TinyBERT
Builds on: tag propagation (Hossain et al.) NoDoze frequency database FastText Doc2Vec TinyBERT
Closest papers by meaning
- A Generalizable Anomaly Detection Method in Dynamic Graphs (AAAI 2025 · similarity 0.84)
- Graph Anomaly Detection as Dynamical Transport: Training-Free Scoring via Empirical Bayes (NeurIPS 2026 · similarity 0.83)
- Self-Supervised Learning of Graph Representations for Network Intrusion Detection (NeurIPS 2025 · similarity 0.83)
- ARC: A Generalist Graph Anomaly Detector with In-Context Learning (NeurIPS 2024 · similarity 0.83)
- Graph Mixture of Experts and Memory-augmented Routers for Multivariate Time Series Anomaly Detection (AAAI 2025 · similarity 0.83)
- Leveraging Diffusion Model as Pseudo-Anomalous Graph Generator for Graph-Level Anomaly Detection (ICML 2025 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.