Work

Brewing Vodka: Distilling Pure Knowledge for Lightweight Threat Detection in Audit Logs

Year: 2025

Type: conference-paper

Abstract: Advanced Persistent Threats (APTs) are continuously evolving, leveraging their stealthiness and persistence to put increasing pressure on current provenance-based Intrusion Detection Systems (IDS). This evolution exposes several critical issues: (1) The dense interaction between malicious and benign nodes within provenance graphs introduces neighbor noise, hindering effective detection; (2) The complex prediction mechanisms of existing APTs detection models lead to the insufficient utilization of prior knowledge embedded in the data; (3) The high computational cost makes detection impractical.

DOI: 10.1145/3696410.3714563

Authors: Weiheng Wu, Wei Qiao, Wenhao Yan, Bo Jiang, Yuling Liu, Baoxu Liu, Zhigang Lu, Junrong Liu

Institutions: Chinese Academy of Sciences, Institute of Information Engineering, University of Chinese Academy of Sciences

Language: English

Topic: Network Security and Intrusion Detection

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

Open Access status: gold

OpenAlex ID: W4409657092

FWCI: 5.143

Cites: 24

Cited by: 4

Related to: 10