GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classification
Robin Buchta, Carsten Kleiner, Felix Heine, Gabi Dreo Rodosek
TLDR
GRASP is a novel provenance-based intrusion detection system that uses self-supervised graph classification to detect advanced persistent threats without thresholds.
Key contributions
- Introduces GRASP, a provenance-based IDS using masked self-supervised classification.
- Infers process executable information from 2-hop graph neighborhoods to identify anomalies.
- Eliminates reliance on predefined thresholds, enhancing detection stability and robustness.
- Outperforms existing systems on DARPA datasets, detecting known and uncovering new anomalies.
Why it matters
This paper introduces a significant advancement in intrusion detection by moving beyond traditional threshold-based systems. GRASP's self-supervised approach offers a more robust and adaptable method for identifying stealthy APT attacks, including previously unknown malicious behaviors. Its strong performance on benchmark datasets makes it a crucial development for cybersecurity.
Original Abstract
Advanced persistent threat (APT) attacks remain difficult to detect due to their stealth, adaptability, and use of legitimate system components. Provenance-based intrusion detection systems (PIDS) offer a promising defense by capturing detailed relationships between system components and actions. However, current PIDS rely on predefined or subset-determined thresholds, which limit detection stability and the ability to detect any anomalous behavior in general. Furthermore, related work often neglects the role of process executables, which describe system activity by interacting through a process with files, network components, and other processes. We introduce GRASP, a PIDS based on masked self-supervised classification. GRASP masks the executable information of processes and learns to infer it from their two-hop provenance graph neighborhood, marking misclassified processes as anomalies. It captures behavior patterns for the learned executables without thresholding, making it robust against interference and unknown activities. Evaluations on the DARPA TC and OpTC datasets demonstrate that GRASP consistently detects anomalous behavior, including known attack-related activities, outperforming existing systems. Our PIDS identifies all documented attacks on datasets where the behavior of executables is learnable. In addition, compared to existing systems, GRASP uncovers potentially malicious anomalous behavior not labeled as an attack in the documentation.
📬 Weekly AI Paper Digest
Get the top 10 AI/ML arXiv papers from the week — summarized, scored, and delivered to your inbox every Monday.