PaperlayerView exact revision on arXiv

Source-linked AI summary

DUPIN: Attack Learning Is Still Needed! Demonstrating Few-Shot after Unsupervised Pretraining Is A Nimble Forensics Learner

Chanwoo Bae, Hailun Ding, Shiqing Ma, Xiangyu Zhang

arXiv:2609.00259v1cs.CR

TL;DR

Attack forensics lacks abundant, reliable labeled attacks, while benign-heavy logs make conventional supervised and one-class approaches difficult. DUPIN pretrains a GAT on provenance graphs with masked prediction and then fine-tunes it using few-shot attack samples. Across 25 APT attack sets from four sources, DUPIN outperforms one-class learners, alternative GNNs, and ablated models, with extensive pretraining improving accuracy by 16%.

  • Problem

    Attack data is sparse and labels are costly and error-prone, limiting supervised training; benign-like malicious behavior also challenges one-class learners.

    Source: §2 · p. 4

  • Method

    DUPIN transforms audit logs into provenance graphs, pretrains a foundation GAT through masked prediction on benign logs, and fine-tunes it with few-shot attack samples.

    Source: §1 · p. 2, §3.2 · p. 5

  • Results

    DUPIN outperforms one-class learners, alternative GNN architectures, and ablated models across 25 APT attack sets from four sources; pretraining improves accuracy by 16%.

    Source: §1 · p. 2, §7 · p. 15

  • Takeaways & Limitations

    Attack learning remains useful when threat techniques recur across actors and sparse attack samples can be combined with broad benign-log pretraining.

    Source: §1 · pp. 1–2

    DUPIN detects only previously observed attack types, so effectiveness depends on attack coverage and requires some attack-data collection.

    Source: §6 · p. 15

Abstract

from arXiv · show

We propose a novel approach to learning-based attack forensics called DUPIN. DUPIN performs unsupervised pre-training on an enormous amount of audit events in the form of provenance graphs. It then proceeds to a few-shot learning stage, leveraging a small number of labeled attack examples to fine-tune its detection capabilities. We pretrain DUPIN on up to 38 - 52 days of audit logs (7.3TB total) and evaluate it against various baselines on 25 APT campaigns across four different data sources, facilitating the scalable evaluation.

1 Introduction

DUPIN addresses the scarcity and complexity of attack data by combining extensive unsupervised pretraining on provenance graphs with few-shot learning from labeled attacks. It is evaluated across diverse APT datasets and reports improved accuracy with extensive pretraining.

  • Attack forensics is difficult because complex APTs hide within extensive benign logs, while trained analysts are limited.Source: §1 · p. 1
  • Sparse attack data makes traditional supervised training difficult, while one-class methods can mistake malicious behaviors for benign activity.Source: §1 · p. 1
  • 85% of attack techniques are used by at least two known threat actors, motivating learning from shared and recurring attack knowledge.Source: §1 · p. 1
  • DUPIN pretrains a Graph Attention Network on benign provenance graphs using masked node, edge, and classification predictions, then fine-tunes it with attack samples.Source: §1 · p. 2
  • 16% accuracy improvement results from extensive DUPIN pretraining in the ablation study.Source: §1 · p. 2
  • Evaluation covers 25 representative APT attack sets from four dataset sources using cross-validation separated by red-team origin.Source: §1 · p. 2

2 Motivation

The motivation section argues that benign-heavy, noisy audit data limits supervised and one-class learning for attack forensics. DUPIN instead uses massive benign-log pretraining followed by few-shot attack fine-tuning to learn attack context beyond superficial activity patterns.

2 Motivation

  • Analysts cannot review entire logs because overwhelming benign activity obscures ongoing attacks.Source: §2 · p. 3
  • Supervised methods require large, accurately labeled datasets, but attacks are rare and labeling is costly and error-prone.Source: §2 · p. 3
  • One-class learners profile benign activity, but benign-like attack behavior can prevent them from recognizing malicious context.Source: §2 · pp. 3–4
  • DUPIN pretrains on massive benign audit logs to learn behavioral context, then uses relatively small attack samples for few-shot fine-tuning.Source: §2 · p. 4
  • Fine-tuning can abstract attack context shared across examples even when individual activities, such as writing multiple files, also occur benignly.Source: §2 · p. 4

3 System Design

DUPIN transforms noisy audit logs into provenance-graph representations and uses a GAT-based architecture with edge-aware attention. Its design combines dynamic file-path tokenization, bounded subgraphs, unsupervised graph pretraining, and downstream classifier adaptation.

System overview

  • DUPIN comprises a tokenizer, graph constructor, base graph model, and attack classifier.These components form the system’s main processing and learning pipeline.Source: §3 · p. 4

3.1 Tokenizer

  • Dynamic token extraction merges redundant file names into format tokens while preserving significant names and bounding vocabulary size.Names recurring in the same directory beyond κ are normalized, with vocabulary constrained by τ.Source: §3.1 · p. 4
  • Path embeddings split file paths into directory, file-name, and extension tokens, then aggregate their embeddings with a recurrent network.The aggregation preserves token order and context; DUPIN uses an LSTM for this purpose.Source: §3.1 · p. 5

3.2 Graph Construction and Subgraphs Extraction

  • DUPIN constructs heterogeneous provenance graphs whose nodes represent entities and whose edges represent interactions, with names and edge types annotated.The full graph is divided into bounded-size subgraphs that serve as training and inference units.Source: §3.2 · p. 5, Table 1 · p. 5

3.3 Architecture of DUPIN

  • The base model is a graph attention network that weights neighboring entities and incorporates edge-type embeddings derived from event embeddings.For multiple events connecting two nodes, the edge representation is the average of their event embeddings.Source: §3.3 · pp. 5–6
  • After graph masked pretraining, DUPIN attaches a classifier for downstream tasks and lowers the base-model learning rate to preserve pretrained context representations.The classifier adapts to the downstream task while alterations to pretrained cells are minimized.Source: Figure 4 · p. 6, §3.4 · p. 7

4 Evaluation

DUPIN is evaluated across diverse attack sources and baselines, with results showing strong detection, few-shot performance, efficiency, and practical forensic utility, alongside graph-temporal limitations.

Evaluation Design

  • Cross-validation separates attack campaigns by dataset source to test whether models focus on fundamental attack contexts rather than shared red-team or victim-environment cues.The evaluation is designed to better reflect evolving and diverse real-world surveillance conditions.Source: §4 · p. 7, §4.1 · p. 9

RQ1: Effectiveness

  • DUPIN outperforms all baselines in TPR, TNR, and AUROC, improving AUROC by 21% over the best baseline and leading in 19 of 25 attack sets.It also achieves the highest true positives in 15 attack sets across all four dataset sources.Source: §4.4 · p. 10
  • With training on remaining attack sets from the same dataset source, DUPIN achieves a TPR of 86% and a TNR of 80%.This relaxed evaluation excludes the target attack set while retaining the dataset source.Source: §4.4 · p. 11

RQ2: Architecture Comparison

  • DUPIN improves AUROC by 5% over GCN and maintains more balanced TPR and TNR than the compared non-attentive GNNs.GIN has higher false negatives, while GCN has higher false positives in the reported comparison.Source: §4.5 · p. 11

RQ2: Baseline Comparison

  • DUPIN outperforms VELOX by 17% in AUROC, despite VELOX outperforming existing unsupervised baselines.Temporal features can improve performance, but DUPIN still achieves the highest overall accuracy in the temporal-feature comparison.Source: §4.5 · p. 11

RQ3: Ablation Study

  • Pretraining and few-shot learning remain effective with limited attack data: DUPIN can outperform baselines using as few as 3 to 5 APT sets.In some cases, a single attack set is sufficient to exceed baseline performance.Source: §4.6 · p. 12

RQ4: Efficiency

  • Pretraining adds little runtime complexity, while total processing remains faster than log accumulation; log parsing and graph construction are the main bottlenecks.The reported accumulated runtime rates are 25.58% and 15.55%, and masked learning rates are 0.24% and 0.38%.Source: §4.7 · pp. 12–13

Case Study

  • Case studies show DUPIN can identify compromise vectors, continuing attack behaviors, and data leakage from raw logs, but graph representations can lose event-time order.The lost temporal relation reduces confidence in at least one attack case, while temporal ordering embeddings are left out of scope.Source: §4.8 · p. 13

5 Related Work

Attack forensics has shifted from rule-based semantic bridging toward data-driven learning, including sequential, graph, and embedding models. DUPIN addresses dataset imbalance by combining large-scale benign provenance pretraining with few-shot supervised adaptation on limited attack data.

  • Audit analysis research increasingly emphasizes effectiveness after improvements in scalability made forensic analysis more feasible.Source: §5 · p. 14
  • Rule-based systems bridge low-level artifacts and human threat knowledge by defining prerequisites or clustering related behaviors.Source: §5 · p. 14
  • Data-driven attack-forensics systems use sequential models, graph learning, and behavioral embeddings, but dataset imbalance remains a major limitation.Source: §5 · p. 14
  • DUPIN combines large-scale self-supervised pretraining on benign provenance with few-shot supervised adaptation on a small attack corpus.Source: §5 · p. 14

6 Limitations

DUPIN’s supervised learning limits detection to attack types observed during training, making performance dependent on attack coverage and requiring attack-data collection despite extensive pretraining.

  • DUPIN can detect only attack types previously observed during supervised learning, leaving rare attacks difficult to identify.Source: §6 · p. 15
  • DUPIN’s effectiveness depends on attack coverage in the dataset, although extensive pretraining reduces the data-collection effort.Source: §6 · p. 15

7 Conclusion

DUPIN combines massive self-supervised pretraining on benign audit logs with few-shot supervised fine-tuning on attack logs, and outperforms several baseline and ablated approaches across 25 APT attack sets from four sources.

  • DUPIN applies massive self-supervised pretraining on benign audit logs followed by few-shot supervised fine-tuning on attack logs.Source: §7 · p. 15
  • Across 25 APT attack sets from four sources, DUPIN outperforms one-class learners, alternative GNN architectures, and ablated models.Source: §7 · p. 15

9 Ethical Considerations

The authors identify ethical risks because attack datasets could be misused, and restrict their stated use to defense research under a code of conduct.

  • Attack datasets carry a risk of misuse, so the authors state that acquired attack knowledge is used solely for defense research.Source: §9 · p. 15
  • Subsequent use of the code, datasets, or artifacts is expected to follow proper attribution and ethical-use requirements.Source: §9 · p. 15

10 Open Science

The authors release code, replication instructions, and an audit-analysis API toolkit, while requiring users to obtain original audit-log datasets from their repositories.

  • The authors release source code and instructions for replicating their evaluation results.Source: §10 · p. 15
  • Original audit-log datasets must be downloaded from their original repositories.Source: §10 · p. 15
  • An API toolkit supports automated parsing of raw logs and provenance-graph construction with limited configuration effort.Source: §10 · p. 15

A The performance of DUPIN on the relaxed cross-validations.

Relaxed cross-validation evaluates each attack set with a model trained on other data from the same source. DUPIN and AirTag improve substantially, while the setup raises evaluation-design concerns.

B The performance of DUPIN on the non-pretrained model.

DUPIN’s pretrained model improves AUROC across most evaluated cases, while the non-pretrained model trails the strongest baseline in TPR and shows only a small AUROC difference.

C Usage of Darpa Trace Dataset.

The DARPA TRACE data provide Linux and Windows tracepoints for attack and benign sets, while separate trace durations are used for DUPIN pretraining.

D Subdivided Results in Our Evaluations

The evaluation materials describe full results for several baseline models and a random provenance-graph subgraph discovery procedure with bounded growth and coverage over all audit-log nodes.

Related papers

Loading 2609.00259v1…