Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Incorporating Gradients to Rules: Towards Lightweight, Adaptive Provenance-based Intrusion Detection

Lingzhi Wang, Xiangmin Shen, Weijian Li, Zhenyuan Li, R. Sekar, Han Liu, Yan Chen

Abstract

As cyber attacks grow increasingly sophisticated and stealthy, it becomes more imperative and challenging to detect intrusion from normal behaviors. Through fine-grained causality analysis, provenance-based intrusion detection systems (PIDS) demonstrated a promising capacity to distinguish benign and malicious behaviors, attracting widespread attention from both industry and academia. Among diverse approaches, rule-based PIDS stands out due to its lightweight overhead, real-time capabilities, and explainability. However, existing rule-based systems suffer low detection accuracy, especially the high false alarms, due to the lack of fine-grained rules and environment-specific configurations. In this paper, we propose CAPTAIN, a rule-based PIDS capable of automatically adapting to diverse environments. Specifically, we propose three adaptive parameters to adjust the detection configuration with respect to nodes, edges, and alarm generation thresholds. We build a differentiable tag propagation framework and utilize the gradient descent algorithm to optimize these adaptive parameters based on the training data. We evaluate our system using data from DARPA Engagements and simulated environments. The evaluation results demonstrate that CAPTAIN enhances rule-based PIDS with learning capabilities, resulting in improved detection accuracy, reduced detection latency, lower runtime overhead, and more interpretable detection procedures and results compared to the state-of-the-art (SOTA) PIDS.

Incorporating Gradients to Rules: Towards Lightweight, Adaptive Provenance-based Intrusion Detection

Abstract

As cyber attacks grow increasingly sophisticated and stealthy, it becomes more imperative and challenging to detect intrusion from normal behaviors. Through fine-grained causality analysis, provenance-based intrusion detection systems (PIDS) demonstrated a promising capacity to distinguish benign and malicious behaviors, attracting widespread attention from both industry and academia. Among diverse approaches, rule-based PIDS stands out due to its lightweight overhead, real-time capabilities, and explainability. However, existing rule-based systems suffer low detection accuracy, especially the high false alarms, due to the lack of fine-grained rules and environment-specific configurations. In this paper, we propose CAPTAIN, a rule-based PIDS capable of automatically adapting to diverse environments. Specifically, we propose three adaptive parameters to adjust the detection configuration with respect to nodes, edges, and alarm generation thresholds. We build a differentiable tag propagation framework and utilize the gradient descent algorithm to optimize these adaptive parameters based on the training data. We evaluate our system using data from DARPA Engagements and simulated environments. The evaluation results demonstrate that CAPTAIN enhances rule-based PIDS with learning capabilities, resulting in improved detection accuracy, reduced detection latency, lower runtime overhead, and more interpretable detection procedures and results compared to the state-of-the-art (SOTA) PIDS.
Paper Structure (46 sections, 21 equations, 9 figures, 9 tables)

This paper contains 46 sections, 21 equations, 9 figures, 9 tables.

Table of Contents

  1. Introduction
  2. Background and Related Work
  3. Provenance-based Intrusion Detection
  4. Configuration as an Optimization Problem
  5. Threat Model & Assumptions
  6. Motivation Examples
  7. System Design
  8. System Overview
  9. Adaptive Detection Module
  10. Learning Module
  11. Loss Function
  12. Differentiable Detection Framework
  13. Training and Testing
  14. Implementation
  15. Evaluation
  16. ...and 31 more sections

Figures (9)

  • Figure 1: A brief overview of the workflow and commonly used techniques in mainstream PIDS.
  • Figure 2: Three motivating examples from the real-world dataset where the more fine-grained rules are needed in the rule-based PIDS.
  • Figure 3: The overall framework of Captain. Phases ①-⑤ show the lifecycle of the detection module and the learning module within one training epoch.
  • Figure 4: Comparison of resource consumption when detecting on DARPA Engagement 3 Cadets. In Fig. \ref{['fig:resource_memory']}, the memory usage curve of Captain and Morse are overlapped, showing their similar efficiency performance.
  • Figure 5: Adversarial mimicry attack against Captain and Flash (use the attack entity /tmp/test as an example)
  • ...and 4 more figures