# Provenance-based Intrusion Detection: Opportunities and Challenges

arXiv: https://arxiv.org/abs/1806.00934 · HTML: https://mlsanity.com/paper/1806.00934/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 Jun 2018.

## Built on by (most cited first, 9 of 9)

- [A Rule Mining-Based Advanced Persistent Threats Detection System](https://mlsanity.com/paper/2105.10053/) (2021)
- [Hack Me If You Can: Aggregating AutoEncoders for Countering Persistent Access Threats Within Highly Imbalanced Data](https://mlsanity.com/paper/2406.19220/) (2024)
- [Adversarial Augmentation and Active Sampling for Robust Cyber Anomaly Detection](https://mlsanity.com/paper/2509.04999/) (2025)
- [Ranking-Enhanced Anomaly Detection Using Active Learning-Assisted Attention Adversarial Dual AutoEncoders](https://mlsanity.com/paper/2511.20480/) (2025)
- [Attackers Strike Back? Not Anymore -- An Ensemble of RL Defenders Awakens for APT Detection](https://mlsanity.com/paper/2508.19072/) (2025)
- [Holmes: An Efficient and Lightweight Semantic Based Anomalous Email Detector](https://mlsanity.com/paper/2104.08044/) (2021)
- [A Heterogeneous Graph Learning Model for Cyber-Attack Detection](https://mlsanity.com/paper/2112.08986/) (2021)
- [GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classification](https://mlsanity.com/paper/2605.07812/) (2026)
- [A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK](https://mlsanity.com/paper/2609.12841/) (2026)

## Abstract (arXiv)

Intrusion detection is an arms race; attackers evade intrusion detection systems by developing new attack vectors to sidestep known defense mechanisms. Provenance provides a detailed, structured history of the interactions of digital objects within a system. It is ideal for intrusion detection, because it offers a holistic, attack-vector-agnostic view of system execution. As such, provenance graph analysis fundamentally strengthens detection robustness. We discuss the opportunities and challenges associated with provenance-based intrusion detection and provide insights based on our experience building such systems.