# A Rule Mining-Based Advanced Persistent Threats Detection System

arXiv: https://arxiv.org/abs/2105.10053 · HTML: https://mlsanity.com/paper/2105.10053/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 37 references that are in the map.
- First posted on arXiv 20 May 2021.

## Builds on (most cited first, 6 of 6)

- [Graph-based Anomaly Detection and Description: A Survey](https://mlsanity.com/paper/1404.4679/) (2014)
- [Fast Memory-efficient Anomaly Detection in Streaming Heterogeneous Graphs](https://mlsanity.com/paper/1602.04844/) (2016)
- [SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data](https://mlsanity.com/paper/1801.02062/) (2018)
- [A baseline for unsupervised advanced persistent threat detection in system-level provenance](https://mlsanity.com/paper/1906.06940/) (2019)
- [Provenance-based Intrusion Detection: Opportunities and Challenges](https://mlsanity.com/paper/1806.00934/) (2018)
- [CICLAD: A Fast and Memory-efficient Closed Itemset Miner for Streams](https://mlsanity.com/paper/2007.01946/) (2020)

## Built on by (most cited first, 8 of 8)

- [Hack Me If You Can: Aggregating AutoEncoders for Countering Persistent Access Threats Within Highly Imbalanced Data](https://mlsanity.com/paper/2406.19220/) (2024)
- [From One Attack Domain to Another: Contrastive Transfer Learning with Siamese Networks for APT Detection](https://mlsanity.com/paper/2511.20500/) (2025)
- [Adversarial Augmentation and Active Sampling for Robust Cyber Anomaly Detection](https://mlsanity.com/paper/2509.04999/) (2025)
- [Ranking-Enhanced Anomaly Detection Using Active Learning-Assisted Attention Adversarial Dual AutoEncoders](https://mlsanity.com/paper/2511.20480/) (2025)
- [Attackers Strike Back? Not Anymore -- An Ensemble of RL Defenders Awakens for APT Detection](https://mlsanity.com/paper/2508.19072/) (2025)
- [Refining Decision Boundaries In Anomaly Detection Using Similarity Search Within the Feature Space](https://mlsanity.com/paper/2602.02925/) (2026)
- [RPG-AE: Neuro-Symbolic Graph Autoencoders with Rare Pattern Mining for Provenance-Based Anomaly Detection](https://mlsanity.com/paper/2602.02929/) (2026)
- [A Source Domain is All You Need: Source-Only Cross-OS Transfer Learning for APT Anomaly Detection via Semantic Alignment and Optimal Transport](https://mlsanity.com/paper/2606.10216/) (2026)

## Abstract (arXiv)

Advanced persistent threats (APT) are stealthy cyber-attacks that are aimed at stealing valuable information from target organizations and tend to extend in time. Blocking all APTs is impossible, security experts caution, hence the importance of research on early detection and damage limitation. Whole-system provenance-tracking and provenance trace mining are considered promising as they can help find causal relationships between activities and flag suspicious event sequences as they occur. We introduce an unsupervised method that exploits OS-independent features reflecting process activity to detect realistic APT-like attacks from provenance traces. Anomalous processes are ranked using both frequent and rare event associations learned from traces. Results are then presented as implications which, since interpretable, help leverage causality in explaining the detected anomalies. When evaluated on Transparent Computing program datasets (DARPA), our method outperformed competing approaches.