Sometimes Simpler is Better: A Comprehensive Analysis of State-of-the-Art...
summary
Eight state-of-the-art provenance-based IDSs are reimplemented in a unified framework, exposing eight systems and nine shortcomings that break practical deployment; a new threshold-independent metric, Attack Detection Precision (ADP), measures per-attack high-precision discovery. A simple text-embedding neural baseline using system entity strings outperforms complex GNNs on the DARPA sets (reported as state-of-the-art on five of seven datasets), runs in real time with ~5 MB memory and >2,000 edges/s, and the code plus preprocessed datasets are open source.
AI-written summary · about
chapters (8)
- 0:00Provenance-based intrusion detection
- 1:37Unified framework for systems
- 3:05Shortcomings in cybersecurity metrics
- 4:56Evaluating anomaly detection
- 7:05VLOOKUX baseline model
- 8:52VLOOKUX performance advantages
- 9:57GNNs in detection systems
- 10:59Future research directions
related talks
48mHunting Stealth Adversaries with Graphs & AI
49mProtecting Sensitive Data in the Age of Generative AI
45mWinning by deception: tactics, techniques, and procedures of adversarial A.I.
45mSecuring AI: There Is No Try, Only Do!
39mTrust Cards For AI
44mApplied Machine Learning for Data Exfil and Other Fun Topics
53mAI-equipped Threat Actors Versus AI-enhanced Cyber Tools: Who Wins?
30mData Driven Security