5 papers
ProHunter: A Comprehensive APT Hunting System Based on Whole-System Provenance
Xuebo Qiu, Mingqi Lv, Yimei Zhang +2
Advanced Persistent Threats (APTs) remain difficult to detect due to their stealthy nature and long-term persistence. To tackle this challenge, provenance-based threat hunting has…
METANOIA: A Lifelong Intrusion Detection and Investigation System for Mitigating Concept Drift
Jie Ying, Mengce Zheng, Jungan Chen +3
As Advanced Persistent Threat (APT) complexity increases, provenance data is increasingly used for detection. Anomaly-based systems are gaining attention due to their attack-knowle…
ActMiner: Applying Causality Tracking and Increment Aligning for Graph-based Cyber Threat Hunting
Mingjun Ma, Tiantian Zhu, Shuang Li +4
To defend against Advanced Persistent Threats on the endpoint, threat hunting employs security knowledge such as cyber threat intelligence to continuously analyze system audit logs…
CCSK:Cognitive Convection of Self-Knowledge Based Retrieval Augmentation for Large Language Models
Jianling Lu, Mingqi Lv, Tieming Chen
The performance of large language models (LLMs) in Q&A task increased substantially through Retrieval-Augmented Generation (RAG) which brings in external knowledge. However, the ma…
DEHYDRATOR: Enhancing Provenance Graph Storage via Hierarchical Encoding and Sequence Generation
Jie Ying, Tiantian Zhu, Mingqi Lv +1
As the scope and impact of cyber threats have expanded, analysts utilize audit logs to hunt threats and investigate attacks. The provenance graphs constructed from kernel logs are…