No Data? No Problem: Synthesizing Security Graphs for Better Intrusion Detection

TL;DR

The results show that PROVSYN effectively mitigates data imbalance, improving normalized entropy by up to 35%, and enhances the generalizability of downstream detection models, achieving an accuracy improvement of up to 38%.

Abstract

Provenance graph analysis plays a vital role in intrusion detection, particularly against Advanced Persistent Threats (APTs), by exposing complex attack patterns. While recent systems combine graph neural networks (GNNs) with natural language processing (NLP) to capture structural and semantic features, their effectiveness is limited by class imbalance in real-world data. To address this, we introduce PROVSYN, a novel hybrid provenance graph synthesis framework, which comprises three components: (1) graph structure synthesis via heterogeneous graph generation models, (2) textual attribute synthesis via fine-tuned Large Language Models (LLMs), and (3) five-dimensional fidelity evaluation. Experiments on six benchmark datasets demonstrate that PROVSYN consistently produces higher-fidelity graphs across the five evaluation dimensions compared to four strong baselines. To further demonstrate the practical utility of PROVSYN, we utilize the synthesized graphs to augment training datasets for downstream APT detection models. The results show that PROVSYN effectively mitigates data imbalance, improving normalized entropy by up to 35%, and enhances the generalizability of downstream detection models, achieving an accuracy improvement of up to 38%.

Figures (7)

• Figure 1: Entity Type and Event Type Distribution in Provenance Dataset in OPTC-H501.
• Figure 2: ProvSyn Architecture. First, a heterogeneous graph generation model constructs the initial structure, which is subsequently refined through rule-based topological constraints. Next, an LLM is fine-tuned on serialized provenance data to capture domain-specific semantics, enabling it to populate the generated nodes with synthesized textual attributes. Finally, the resulting graphs are validated via a fidelity evaluation framework across five distinct dimensions.
• Figure 3: Comparison of semantic accurary across different models and datasets. Higher values indicate better performance.
• Figure 4: Entity Type and Event Type Distribution in Provenance Dataset.
• Figure 5: Hidden size setting and inference temperature setting.