Relation-aware graph method improves intrusion detection accuracy
Not All Relations Are Equal: Relation-Balanced and Calibrated Graph Learning for Provenance-Based Intrusion Detection
Cryptography and SecurityMachine Learning
Summary
Detecting hidden computer attacks often involves looking at how system parts interact. Many existing methods treat all these interactions the same, even though some happen way more often than others. The authors created RECAL, which adjusts for how common or rare these interactions are, helping to spot attacks more accurately without raising many false alarms. When tested on real datasets, RECAL showed better accuracy and fewer false alerts compared to previous best methods.
What this means in practice
- •For cybersecurity teams: Improve detection of advanced system attacks by balancing attention to rare and frequent system events, reducing false alarms in provenance-based monitoring.
- •For enterprise it security teams: Deploy more accurate unsupervised intrusion detection to monitor complex system interactions typical in large organizations, enhancing threat visibility.
Authors
Lijie Zheng, Ji He, Alessandro Brighente, Yulong Shen, Mauro Conti
Abstract
Provenance-Based Intrusion Detection Systems (PIDSs) detect Advanced Persistent Threats (APTs) by analyzing system interactions. However, existing methods largely treat relations uniformly, overlooking statistical heterogeneity; in CADETS, relation frequencies differ by approximately $140{,}000\times$. This may cause PIDSs to focus more on frequent relations and overlook differences in normal error levels across relations, increasing the risk of false alarms and missed detections. We present RECAL, an unsupervised framework using relation-balanced masked graph learning to better capture rare interaction patterns. It further calibrates reconstruction errors against each relation's benign error distribution to produce comparable anomaly evidence, helping distinguish attacks from benign behavior and reduce false alarms. On three DARPA E3 datasets, RECAL achieves F1 scores of 99.99\%, 99.93\%, and 99.99\%, outperforming the best baseline on each dataset by 0.88, 0.82, and 0.42 percentage points, respectively. Compared with the baseline reporting the lowest FPR, RECAL reduces mean FPR by approximately $105\times$, $4\times$, and $41\times$.