Provenance-based Intrusion Detection: Opportunities and Challenges
Not on the map. Why?
Abstract (arXiv)
Intrusion detection is an arms race; attackers evade intrusion detection systems by developing new attack vectors to sidestep known defense mechanisms. Provenance provides a detailed, structured history of the interactions of digital objects within a system. It is ideal for intrusion detection, because it offers a holistic, attack-vector-agnostic view of system execution. As such, provenance graph analysis fundamentally strengthens detection robustness. We discuss the opportunities and challenges associated with provenance-based intrusion detection and provide insights based on our experience building such systems.
Key facts. Cited by 9 papers in the map (data through 14 Oct 2026). First posted on arXiv 4 Jun 2018.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2021: 3; 2022: 0; 2023: 0; 2024: 1; 2025: 3; 2026: 2.
9 papers.
- 2021A Rule Mining-Based Advanced Persistent Threats Detection Systemcited by 8
- 2024Hack Me If You Can: Aggregating AutoEncoders for Countering Persistent Access Threats Within Highly Imbalanced Datacited by 5
- 2025Adversarial Augmentation and Active Sampling for Robust Cyber Anomaly Detectioncited by 2
- 2025Ranking-Enhanced Anomaly Detection Using Active Learning-Assisted Attention Adversarial Dual AutoEncoderscited by 2
- 2025Attackers Strike Back? Not Anymore -- An Ensemble of RL Defenders Awakens for APT Detectioncited by 1
- 2021Holmes: An Efficient and Lightweight Semantic Based Anomalous Email Detectorcited by 0
- 2021A Heterogeneous Graph Learning Model for Cyber-Attack Detectioncited by 0
- 2026GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classificationcited by 0
- 2026A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CKcited by 0
- 2026A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK11 Sep 2026
- 2026GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classification8 May 2026
- 2025Ranking-Enhanced Anomaly Detection Using Active Learning-Assisted Attention Adversarial Dual AutoEncoders25 Nov 2025
- 2025Adversarial Augmentation and Active Sampling for Robust Cyber Anomaly Detection5 Sep 2025
- 2025Attackers Strike Back? Not Anymore -- An Ensemble of RL Defenders Awakens for APT Detection26 Aug 2025
- 2024Hack Me If You Can: Aggregating AutoEncoders for Countering Persistent Access Threats Within Highly Imbalanced Data27 Jun 2024
- 2021A Heterogeneous Graph Learning Model for Cyber-Attack Detection16 Dec 2021
- 2021A Rule Mining-Based Advanced Persistent Threats Detection System20 May 2021
- 2021Holmes: An Efficient and Lightweight Semantic Based Anomalous Email Detector16 Apr 2021