PaperlayerView exact revision on arXiv

Source-linked AI summary

threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learning

Su Wang, Zhiliang Wang, Tao Zhou, Xia Yin, Dongqi Han, Han Zhang, Hongbin Sun, Xingang Shi, Jiahai Yang

arXiv:2111.04333v1cs.CRcs.LG

TL;DR

Host-based threat detectors can miss stealthy attacks because anomalous entities are a small part of otherwise benign provenance graphs, while misuse methods require attack patterns. THREATRACE uses multi-model GraphSAGE to learn benign node roles, detect and locate anomalous entities in real time, and outperforms three state-of-the-art systems across three public datasets. Its coverage remains limited by provenance granularity and the closed-world assumption.

  • Problem

    Whole-graph methods are insensitive to small numbers of anomalous nodes, while misuse-based methods lack unknown-threat detection without prior attack patterns.

  • Method

    THREATRACE tailors inductive GraphSAGE in a multi-model framework that learns different benign node roles for node-level anomaly detection and tracing.

  • Results

    Across three public datasets, THREATRACE outperforms three state-of-the-art host intrusion detection approaches and successfully detects and traces anomalous elements.

  • Takeaways & Limitations

    THREATRACE supports real-time, long-term host monitoring with early intrusion detection, anomaly localization, fast processing, and acceptable resource overhead.

  • Takeaways & Limitations

    Provenance granularity can exclude malicious file-code and thread-based threats from THREATRACE’s detection scope.

Abstract

from arXiv · show

Host-based threats such as Program Attack, Malware Implantation, and Advanced Persistent Threats (APT), are commonly adopted by modern attackers. Recent studies propose leveraging the rich contextual information in data provenance to detect threats in a host. Data provenance is a directed acyclic graph constructed from system audit data. Nodes in a provenance graph represent system entities (e.g., $processes$ and $files$) and edges represent system calls in the direction of information flow. However, previous studies, which extract features of the whole provenance graph, are not sensitive to the small number of threat-related entities and thus result in low performance when hunting stealthy threats. We present threaTrace, an anomaly-based detector that detects host-based threats at system entity level without prior knowledge of attack patterns. We tailor GraphSAGE, an inductive graph neural network, to learn every benign entity's role in a provenance graph. threaTrace is a real-time system, which is scalable of monitoring a long-term running host and capable of detecting host-based intrusion in their early phase. We evaluate threaTrace on three public datasets. The results show that threaTrace outperforms three state-of-the-art host intrusion detection systems.

I. INTRODUCTION

THREATRACE addresses stealthy host-based threats by detecting and tracing anomalous entities in provenance graphs without prior attack-pattern knowledge. It uses GraphSAGE-based multi-model learning and reports stronger detection and tracing than three state-of-the-art approaches across three public datasets.

  • Motivation: Stealthy intrusion campaigns and zero-day exploits make host-based threats difficult to detect.Attackers hide malicious activity among benign behavior, while misuse-based methods depend on known attack patterns.
  • Limitations of prior work: Whole-provenance-graph methods are insensitive to small numbers of anomalous nodes and cannot locate their positions.This limits both detection of stealthy threats and subsequent tracing or system repair.
  • Approach: THREATRACE tailors GraphSAGE to learn each benign node’s role and detect stealthy threats at node level.The approach uses provenance context and structural information rather than prior attack patterns.
  • Approach: A multi-model framework learns different benign-node types to address data imbalance and improve detection performance.The framework also includes probability-based training and execution methods to reduce false positives and false negatives.
  • System capability: THREATRACE is designed for real-time, long-term monitoring with early intrusion detection and anomaly localization.The authors report fast processing and acceptable computation and memory overhead.
  • Evaluation: Across three public datasets, THREATRACE outperforms three state-of-the-art host intrusion detection approaches and successfully traces anomalous elements.The evaluation covers both detection performance and threats-tracing ability.

III. BACKGROUND & MOTIVATION

The background motivates node-level provenance analysis because stealthy attacks can resemble benign whole graphs while anomalous entities remain structurally distinctive. THREATRACE uses streaming-compatible GraphSAGE to detect and locate those entities with greater scalability than whole-graph approaches.

  • Provenance background: Data provenance is a directed acyclic graph from system audit data that represents relationships between system subjects and objects.Its contextual information supports host-based threat detection.
  • GraphSAGE background: Inductive GraphSAGE generates node embeddings from features and operates on evolving graphs, making it suitable for streaming provenance analysis.The model learns an embedding function rather than embedding only one fixed graph.
  • Prior-method limitations: Rule-based detection faces a trade-off between false alarms from macroscopic rules and missed zero-day attacks from micro rules.The difficulty arises because many MITRE ATT&CK behaviors are only sometimes malicious.
  • Motivation: Whole-graph anomaly methods can miss stealthy attacks when anomalous nodes comprise less than 1% of the graph.The motivating example contains millions of benign nodes and fewer than 30000 anomalous nodes.
  • Motivation: Whole-graph methods raise graph-level alarms without identifying the specific attack entities needed for remediation.The example names /home/admin/profile as an entity such methods cannot isolate.
  • Scalability: Methods that store provenance graphs in memory lack scalability for long-term running systems.This creates a practicality concern for continuous host monitoring.
  • Approach intuition: THREATRACE formalizes intrusion detection as anomalous-node detection because malicious nodes can retain different local behavior from benign nodes.The motivating example contrasts a process with thousands of remote connections against a benign process.

IV. THREAT MODEL

The threat model considers stealthy, persistent attackers who frequently use zero-day exploits but still leave distinguishing local structures in provenance graphs. THREATRACE detects entities whose behavior differs from learned benign entities, subject to provenance-granularity and modeling assumptions.

  • Adversary characteristics: The adversary is modeled as stealthy, mixing malicious activity with benign background data to resemble normal system behavior.This assumption captures attackers who consciously hide their activities.
  • Adversary characteristics: The attack is persistent and tends to last for a long time.Persistence is an explicit characteristic of the modeled adversary.
  • Adversary characteristics: The model assumes frequent zero-day exploitation and therefore no attack patterns are available for training.This supports an anomaly-based rather than misuse-based detection setting.
  • Provenance assumptions: Attack behavior is assumed to leave provenance patterns that make an attacker node’s local structure different from benign nodes with the same label.The paper gives sudden file reading and writing by a previously file-inactive process as an example.
  • Scope boundary: The approach’s threat coverage is constrained by provenance granularity, excluding some malicious-file-code and thread-based threats.The paper identifies finer-grained text and thread activities as outside the detection scope.
  • Entity definitions: An entity is benign when no malicious activity relates to it and abnormal when its behavior differs from that of a benign entity.THREATRACE monitors provenance-graph nodes to detect these anomalous entities.
  • System assumptions: THREATRACE assumes correct provenance collection and that GraphSAGE can learn structural information about node roles.The latter assumption is attributed to prior work.

• (§V-A) Data Provenance Generator.

THREATRACE collects streaming audit data and transforms it into a provenance graph for subsequent analysis, supporting node-level threat detection and tracing.

  • The generator collects system audit data in streaming mode and transforms it into a data provenance graph.
  • The system uses Camflow to construct a time-ordered, whole-system provenance graph with security and completeness guarantees for information-flow capture.
  • The provenance graph is stored and processed by THREATRACE’s data storage, model, and alert-and-trace components.

B. Data Storage

Data Storage preserves the complete provenance history on disk while maintaining a bounded in-memory subgraph for training and detection, enabling streaming operation and scalability.

  • Incoming nodes and edges are appended to a disk-resident whole graph, while memory retains active nodes, related nodes, and connecting edges.Related nodes are entities that can reach an active node within two hops.
  • THREATRACE assigns node-type labels and edge-count features, then trains GraphSAGE in supervised mode using benign data without abnormal samples.Features encode counts of incoming and outgoing edge types related to each node.
  • GraphSAGE aggregates information from node ancestors and outputs vector representations whose largest element determines the predicted node class.THREATRACE sets the hop number K to 2 to balance representation ability and runtime overhead.
  • Multiple submodels learn underrepresented node classes and nodes sharing dominant labels but differing in hidden roles.A list of not-yet-correctly-classified nodes guides iterative submodel training.
  • A probability threshold accepts classifications only when the predicted class sufficiently exceeds the second-most-probable class, reducing false positives.The paper reports that higher thresholds produce more submodels and fewer false positives during execution.
  • During execution, bounded subgraphs are refreshed after a configured number of incoming edges, allowing dynamic detection of currently active entities.The executing phase maintains a streaming subgraph and reconstructs it when the Subgraph Size threshold is reached.

D. Alert and Trace

Alert and Trace buffers detected abnormal nodes before raising alerts, then traces suspicious behavior through their local two-hop provenance neighborhood.

  • Detected abnormal nodes enter a queue and are retained for a waiting threshold before being treated as confirmed anomalies.This delay accommodates nodes whose behavior may change as they reach a later stage.
  • THREATRACE raises a system alert when queued abnormal nodes exceed the tolerant threshold and traces their two-hop ancestors and descendants.

VI. EVALUATION

The evaluation uses three public datasets to compare detection performance, assess tracing and early detection, examine parameters and overhead, and test robustness against adaptive attacks.

  • The evaluation examines detection performance, parameter influence, anomaly tracing, early intrusion detection, runtime overhead, and robustness against adaptive attacks.
  • THREATRACE is compared with StreamSpot, Unicorn, and ProvDetector, three state-of-the-art anomaly-based host-threat detectors.StreamSpot and Unicorn are implemented from open-source projects, while ProvDetector is reimplemented from its original paper.
  • The authors report better detection performance for THREATRACE on both comparison datasets.
  • Experimental settings include GraphSAGE hyperparameters, manually selected parameters, and runtime-related configurations summarized in Table I.

A. StreamSpot Dataset

On the StreamSpot dataset, THREATRACE is compared with StreamSpot and Unicorn and achieves perfect detection, including stealthier attack graphs.

  • The dataset contains 600 information-flow graphs from five benign scenes and one attack scene.
  • The evaluation trains on 375 benign graphs and tests on 125 benign plus 25 attack graphs.
  • THREATRACE achieves perfect detection performance on the StreamSpot dataset.
  • Five attack graphs are substantially more stealthy because they resemble the YouTube scene rather than the other attack graphs.
  • THREATRACE detects these stealthier intrusion graphs, whereas Unicorn does not detect every abnormal graph.

B. Unicorn SC-2 Dataset

On the more complex Unicorn SC-2 dataset, THREATRACE performs better with two-hop neighborhoods and outperforms Unicorn while raising alerts for few nodes.

  • The dataset is more complex than StreamSpot’s and reflects attackers who act more stealthily with prior system knowledge.
  • The evaluation uses five-fold cross-validation with four benign groups for training and one benign group plus 25 attack graphs for validation.
  • THREATRACE achieves better detection performance than Unicorn on Unicorn’s own dataset.
  • K = 2 produces better detection performance than K = 1, indicating that adequate neighbor information benefits detection.
  • THREATRACE raises alerts for fewer than 10 nodes in most attack graphs.

C. DARPA TC Dataset

The DARPA TC evaluation tests node-level detection, anomaly tracing, graph-level detection, and long-running intrusion behavior using provenance data with ground-truth abnormal nodes.

  • DARPA TC provides publicly available provenance data and ground truth for labeling abnormal nodes and evaluating anomaly tracing.
  • The dataset spans two weeks and contains millions of benign nodes, thousands of abnormal nodes, and millions of edges across four systems.
  • Node-level evaluation: Node-level evaluation defines true positives using detected anomalous nodes or anomalous nodes within two-hop ancestor or descendant neighborhoods.
  • Node-level evaluation: The tracing-cost assumption is supported by an average of 1.8 two-hop ancestors and descendants per node in this dataset.
  • Results: Graph-level results show good detection performance for both THREATRACE and comparison methods, but node-level comparison is unavailable because baselines do not detect anomalous nodes.
  • Case study: THREATRACE raises alerts for important attack components even when anomalous nodes comprise less than 1% of the provenance graph.
  • Case study: The case study shows alerts for the darkon executable, remote shell, privilege escalation, malicious IP activity, micro apt, scan.exe, and a scanned IP object.
  • Case study: THREATRACE detects early attack steps such as darkon and privilege escalation but misses auxiliary components including libdarkon.so and two malicious IP addresses.

D. Influence of Different Parameters

THREATRACE’s parameters affect detection and runtime differently: SS and BS have limited detection influence, while runtime varies with SS and BS. The parameter effects align with the system’s design and support performance tuning.

  • Subgraph Size (SS): SS has little influence on detection performance but substantially affects runtime performance.SS controls when streaming subgraphs are transferred for detection, changing the interval at which benign nodes can reach their final stage.
  • Batch Size (BS): BS has almost no influence on detection performance, with its runtime effects evaluated separately.The reported detection result may reflect the randomly split dataset.
  • Rate threshold (R): Detection performance improves as R increases from 1.0 to 1.5, remains stable from 1.5 to 2.0, and tends to decrease beyond 2.0.R is the rate threshold used during training.
  • Waiting thresholds (T and ˆT): T gives benign nodes more evolutionary time, producing higher Precision and lower Recall as the waiting threshold increases.T is the waiting-time threshold for benign nodes to reach their final stage during real-time streaming detection.
  • Runtime performance: Runtime processing speed increases with BS before flattening and improves as SS increases.The runtime evaluation varies parameters while keeping the remaining parameters constant.
  • Resource usage: THREATRACE uses more CPU and memory than Unicorn and ProvDetector, reflecting the resource demands of its deep-learning-based method.Varying BS and SS has no significant impact on memory usage, while CPU utilization decreases as SS increases.

F. Adaptive attacks

THREATRACE is evaluated against an optimization-based evasion attack that perturbs anomalous-node features to make them evade node classification. The attack considers adversaries with training data or with knowledge of the trained model.

  • Attack methodology: The optimization-based evasion attack targets abnormal nodes by making THREATRACE classify them into the correct class.The attack is designed for graph-based detectors and operates during the execution phase.
  • Attack methodology: The attack constrains feature perturbations by requiring ||x||2 < δa.δa limits the perturbation, and the attacker is assumed to know THREATRACE’s feature extraction method.
  • Attacker knowledge: Attackers with training data first find a benign training node most similar to the anomalous node and having the same class.The second step solves the resulting optimization problem.
  • Attacker knowledge: Attackers with THREATRACE’s model can solve the optimization directly using the model loss, minimizing loss for an anomalous sample.The evaluation applies the approach to abnormal nodes detected by THREATRACE in the Unicorn SC-2 dataset.

VII. DISCUSSION & LIMITATION

THREATRACE provides real-time node-level detection and tracing, but its effectiveness is bounded by training coverage, adversarial robustness, workload realism, system resources, false positives, and provenance granularity.

  • Closed-world assumption: THREATRACE assumes benign behavior is represented in training data, but administrators can periodically update models with new benign provenance without retraining previous models.The authors note that complete benign coverage is difficult in rapidly changing systems.
  • Adversarial attacks: The evaluated robustness target covers evasion attacks, while poisoning and graph-backdoor attacks remain possible failures for future study.The authors distinguish their inductive model from robustness methods designed for transductive graph convolutional networks.
  • Evaluation: Public host-threat datasets may not represent typical real-world workloads, motivating datasets that better reflect operational conditions while preserving privacy and confidentiality.The authors contrast manually constructed environments with red-team versus blue-team engagements.
  • System overhead: On low-performance hosts, batch size and sampling size must trade detection timeliness against overhead, and offline detection may be required in the worst case.The system otherwise demonstrates fast processing and acceptable overhead in the reported evaluation.
  • Threat fatigue problem: THREATRACE still raises many false positives in DARPA TC datasets, limiting false-positive control when provenance graphs contain many benign nodes.The authors associate this issue with the large number of benign nodes and identify it as a threat-fatigue concern.
  • Granularity of data provenance: Provenance-based detection can miss malicious file code and thread-based threats whose behavior is finer-grained than the provenance graph.The authors propose improving provenance granularity or using another data source.
Loading 2111.04333v1…