# A baseline for unsupervised advanced persistent threat detection in system-level provenance

arXiv: https://arxiv.org/abs/1906.06940 · HTML: https://mlsanity.com/paper/1906.06940/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Jun 2019.

## Built on by (most cited first, 12 of 12)

- [Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance](https://mlsanity.com/paper/2308.05034/) (2023)
- [A Rule Mining-Based Advanced Persistent Threats Detection System](https://mlsanity.com/paper/2105.10053/) (2021)
- [Hack Me If You Can: Aggregating AutoEncoders for Countering Persistent Access Threats Within Highly Imbalanced Data](https://mlsanity.com/paper/2406.19220/) (2024)
- [From One Attack Domain to Another: Contrastive Transfer Learning with Siamese Networks for APT Detection](https://mlsanity.com/paper/2511.20500/) (2025)
- [Adversarial Augmentation and Active Sampling for Robust Cyber Anomaly Detection](https://mlsanity.com/paper/2509.04999/) (2025)
- [Ranking-Enhanced Anomaly Detection Using Active Learning-Assisted Attention Adversarial Dual AutoEncoders](https://mlsanity.com/paper/2511.20480/) (2025)
- [Attackers Strike Back? Not Anymore -- An Ensemble of RL Defenders Awakens for APT Detection](https://mlsanity.com/paper/2508.19072/) (2025)
- [A Heterogeneous Graph Learning Model for Cyber-Attack Detection](https://mlsanity.com/paper/2112.08986/) (2021)
- [Semantic-Aware Advanced Persistent Threat Detection Using Autoencoders on LLM-Encoded System Logs](https://mlsanity.com/paper/2602.00204/) (2026)
- [Refining Decision Boundaries In Anomaly Detection Using Similarity Search Within the Feature Space](https://mlsanity.com/paper/2602.02925/) (2026)
- [RPG-AE: Neuro-Symbolic Graph Autoencoders with Rare Pattern Mining for Provenance-Based Anomaly Detection](https://mlsanity.com/paper/2602.02929/) (2026)
- [A Source Domain is All You Need: Source-Only Cross-OS Transfer Learning for APT Anomaly Detection via Semantic Alignment and Optimal Transport](https://mlsanity.com/paper/2606.10216/) (2026)

## Abstract (arXiv)

Advanced persistent threats (APT) are stealthy, sophisticated, and unpredictable cyberattacks that can steal intellectual property, damage critical infrastructure, or cause millions of dollars in damage. Detecting APTs by monitoring system-level activity is difficult because manually inspecting the high volume of normal system activity is overwhelming for security analysts. We evaluate the effectiveness of unsupervised batch and streaming anomaly detection algorithms over multiple gigabytes of provenance traces recorded on four different operating systems to determine whether they can detect realistic APT-like attacks reliably and efficiently. This report is the first detailed study of the effectiveness of generic unsupervised anomaly detection techniques in this setting.