mlsanityData to 7 Oct 2026

UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

arXiv 2001.01525 ↗First posted 6 Jan 2020cs.CRcited by 53

Not on the map. Why?

Abstract (arXiv)

Advanced Persistent Threats (APTs) are difficult to detect due to their "low-and-slow" attack patterns and frequent use of zero-day exploits. We present UNICORN, an anomaly-based APT detector that effectively leverages data provenance analysis. From modeling to detection, UNICORN tailors its design specifically for the unique characteristics of APTs. Through extensive yet time-efficient graph analysis, UNICORN explores provenance graphs that provide rich contextual and historical information to identify stealthy anomalous activities without pre-defined attack signatures. Using a graph sketching technique, it summarizes long-running system execution with space efficiency to combat slow-acting attacks that take place over a long time span. UNICORN further improves its detection capability using a novel modeling approach to understand long-term behavior as the system evolves. Our evaluation shows that UNICORN outperforms an existing state-of-the-art APT detection system and detects real-life APT scenarios with high accuracy.

Key facts. Cited by 53 papers in the map (data through 7 Oct 2026). First posted on arXiv 6 Jan 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 8; 2022: 2; 2023: 8; 2024: 8; 2025: 11; 2026: 16.

53 papers.

Sort:

By area:

  1. 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 63
  2. 2025Contextual Agent Security: A Policy for Every Purposecited by 55
  3. 2023Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenancecited by 30
  4. 2021threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learningcited by 22
  5. 2023MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learningcited by 20
  6. 2021DeepAID: Interpreting and Improving Deep Learning-based Anomaly Detection in Security Applicationscited by 18
  7. 2023SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detectioncited by 13
  8. 2024Beyond MOT: Semantic Multi-Object Trackingcited by 11
  9. 2021PassFlow: Guessing Passwords with Generative Flowscited by 10
  10. 2024LaMOT: Language-Guided Multi-Object Trackingcited by 9
  11. 2023Performance Optimization using Multimodal Modeling and Heterogeneous GNNcited by 7
  12. 2022Anomaly Detection in Multiplex Dynamic Networks: from Blockchain Security to Brain Disease Predictioncited by 6
38 more
  1. 2024TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learningcited by 6
  2. 2025OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMscited by 6
  3. 2024Hack Me If You Can: Aggregating AutoEncoders for Countering Persistent Access Threats Within Highly Imbalanced Datacited by 5
  4. 2025Automated Alert Classification and Triage (AACT): An Intelligent System for the Prioritisation of Cybersecurity Alertscited by 4
  5. 2026Safeguarding LLM Agents from Misalignment through Provenance Analysiscited by 4
  6. 2021ANUBIS: A Provenance Graph-Based Framework for Advanced Persistent Threat Detectioncited by 3
  7. 2025OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Promptingcited by 3
  8. 2026Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systemscited by 3
  9. 2026DiagChain: A Diagnostic Benchmark for Evaluating LLM Agents on Evidence-Grounded Attack Chain Reconstructioncited by 3
  10. 2025Deep Learning-based Intrusion Detection Systems: A Surveycited by 2
  11. 2025CAT: Can Trust be Predicted with Context-Awareness in Dynamic Heterogeneous Networks?cited by 2
  12. 2026Benchmarking and Exploring the Capabilities of LLMs for Attack Investigationscited by 2
  13. 2021RANK: AI-assisted End-to-End Architecture for Detecting Persistent Attacks in Enterprise Networkscited by 1
  14. 2021Evidential Cyber Threat Huntingcited by 1
  15. 2023TBDetector:Transformer-Based Detector for Advanced Persistent Threats with Provenance Graphcited by 1
  16. 2023Interpreting GNN-based IDS Detections Using Provenance Graph Structural Featurescited by 1
  17. 2024Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logscited by 1
  18. 2025PROVCREATOR: Synthesizing Complex Heterogenous Graphs with Node and Edge Attributescited by 1
  19. 2026PIDSMaker: Building and Evaluating Provenance-based Intrusion Detection Systemscited by 1
  20. 2021Holmes: An Efficient and Lightweight Semantic Based Anomalous Email Detectorcited by 0
  21. 2021A Heterogeneous Graph Learning Model for Cyber-Attack Detectioncited by 0
  22. 2022Flurry: a Fast Framework for Reproducible Multi-layered Provenance Graph Representation Learningcited by 0
  23. 2023Host-Based Network Intrusion Detection via Feature Flattening and Two-stage Collaborative Classifiercited by 0
  24. 2023LogShield: A Transformer-based APT Detection System Leveraging Self-Attentioncited by 0
  25. 2024RAPID: Robust APT Detection and Investigation Using Context-Aware Deep Learningcited by 0
  26. 2024Unintentional Security Flaws in Code: Automated Defense via Root Cause Analysiscited by 0
  27. 2025CONTINUUM: Detecting APT Attacks through Spatial-Temporal Graph Neural Networkscited by 0
  28. 2025DeepProv: Behavioral Characterization and Repair of Neural Networks via Inference Provenance Graph Analysiscited by 0
  29. 2025A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detectioncited by 0
  30. 2025PROVEX: Enhancing SOC Analyst Trust with Explainable Provenance-Based IDScited by 0
  31. 2026RPG-AE: Neuro-Symbolic Graph Autoencoders with Rare Pattern Mining for Provenance-Based Anomaly Detectioncited by 0
  32. 2026GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classificationcited by 0
  33. 2026GenAI-Driven Threat Detection with Microsoft Security Copilotcited by 0
  34. 2026PocketAgents: A Manifest-Driven Library of Autonomous Defense Agentscited by 0
  35. 2026TGCM: Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequencescited by 0
  36. 2026How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detectioncited by 0
  37. 2026Structurally Close, Temporally Distant: Measuring Security Exposure in Long-Horizon LLM Agentscited by 0
  38. 2026BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defensecited by 0

50 most cited of 53 All 53 (JSON)