Comprehensive Analysis of Provenance-Based APT Detection: An Evaluation-First Modeling Perspective
Year: 2026
Type: article
Abstract: Advanced Persistent Threats (APTs) are multi-stage campaigns whose stealthy activity can be surfaced using system-level provenance. Although many provenance-based intrusion detection systems (PIDS) have been proposed, their evaluations remain difficult to compare because studies report results at different granularities, use inconsistent stage language and metrics, and frequently omit the denominators needed to interpret campaign-level claims. This paper presents an evaluation-first perspective on peer-reviewed provenance-based APT detection research by synthesizing 76 studies published in 2017--2025, normalizing analysis and alerting to canonical evidence units (node, subgraph, and graph), aligning stage descriptions to a MITRE ATT&CK--consistent taxonomy, and tracing how methodological choices map to Security Operations Center (SOC) functions and analyst-facing outputs. The synthesis indicates that anomaly-driven learning dominates detection-oriented pipelines, while triage and storyline support center on node-level artifacts in one-twelfth of studies each (within the subset with mappable alert units), and it highlights pervasive reporting gaps in alert units, operational metrics, robustness testing, and end-to-end evaluation assumptions that limit reproducibility and operational interpretation. To enable campaign-level comparability, Campaign Recall (CR) is introduced as a standardized campaign-breadth measure with a reproducible denominator protocol grounded in observable stages derived from documented scenario mappings and an explicit evidence rule. Finally, leakage-aware evaluation guidance, dataset--metric compatibility notes, and a concise reporting checklist are provided to improve comparability and SOC relevance in future provenance-based APT detection studies.
Authors: Mustafa İpekbayrak, Zeynep Gürkaş Aydın
Institution: Istanbul University-Cerrahpaşa
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
Funder: Istanbul Üniversitesi-Cerrahpasa
OpenAlex ID: W7129083347