Work

DUPIN: Attack Learning Is Still Needed! Demonstrating Few-Shot after Unsupervised Pretraining Is A Nimble Forensics Learner

Year: 2026

Type: preprint

Abstract: We propose a novel approach to learning-based attack forensics called DUPIN. DUPIN performs unsupervised pre-training on an enormous amount of audit events in the form of provenance graphs. It then proceeds to a few-shot learning stage, leveraging a small number of labeled attack examples to fine-tune its detection capabilities. We pretrain DUPIN on up to 38 - 52 days of audit logs (7.3TB total) and evaluate it against various baselines on 25 APT campaigns across four different data sources, facilitating the scalable evaluation.

Source: arXiv (Cornell University)

DOI: 10.48550/arxiv.2609.00259

Authors: Bae, Chanwoo, Ding, Hailun, Ma, Shiqing, Zhang, Xiangyu

Institutions: Purdue University West Lafayette, IBM (United States), University of Massachusetts Amherst

Topic: Network Security and Intrusion Detection

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

Open Access status: green

OpenAlex ID: W7206204803

Cites:

Cited by:

Related to: