Abstract: In recent years,advanced persistent threat(APT) attacks have become increasingly prevalent.Data provenance graphs,which contain rich contextual information reflecting process execution,have shown potential for detecting APT attacks.Therefore,provenance-based intrusion detection systems(PIDS) have garnered attention.PIDS identify malicious behavior by capturing system logs to generate provenance graphs.PIDS encounter the following main challenges:efficiency,generality,and real-time capability,particularly in terms of efficiency.Current PIDS generate thousands of alerts for a single anomalous node or graph,lea-ding to a significant number of false positives,which inconveniences security personnel.This paper presents Augmenter,the first PIDS simultaneously addresses the three aforementioned challenges.Augmenter partitions processes into communities based on the information fields of nodes,effectively learning the behavior of different processes.Additionally,Augmenter introduces a time-window strategy for subgraph partitioning and employs an unsupervised feature extraction method based on graph mutual information maximization.The incremental feature extraction algorithm amplifies abnormal behavior and distinguishes it from normal behavior.Finally,Augmenter trains multiple clustering models based on process types to achieve event-level detection,allowing for more precise localization of attack behaviors.Augmenter is evaluated on the DARPA dataset,confirming its real-time performance by measuring the efficiency of the detection phase.In terms of detection efficiency,we compare the precision and recall rates with the state-of-the-art works,Kairos and ThreaTrace.Kairos achieves precision and recall rates of 0.17 and 0.80,while ThreaTrace achieves 0.29 and 0.76.In contrast,Augmenter achieves precision and recall rates of 0.83 and 0.97,demonstrating that Augmenter has significantly higher precision and detection performance.

Key words: Advanced persistent threat, Data provenance graph, Intrusion detection, Incremental feature, Abnormal behavior