mlsanityData to 7 Oct 2026

threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learning

arXiv 2111.04333 ↗First posted 8 Nov 2021cs.CR cs.LGcited by 22

Not on the map. Why?

Abstract (arXiv)

Host-based threats such as Program Attack, Malware Implantation, and Advanced Persistent Threats (APT), are commonly adopted by modern attackers. Recent studies propose leveraging the rich contextual information in data provenance to detect threats in a host. Data provenance is a directed acyclic graph constructed from system audit data. Nodes in a provenance graph represent system entities (e.g., processes and files) and edges represent system calls in the direction of information flow. However, previous studies, which extract features of the whole provenance graph, are not sensitive to the small number of threat-related entities and thus result in low performance when hunting stealthy threats. We present threaTrace, an anomaly-based detector that detects host-based threats at system entity level without prior knowledge of attack patterns. We tailor GraphSAGE, an inductive graph neural network, to learn every benign entity's role in a provenance graph. threaTrace is a real-time system, which is scalable of monitoring a long-term running host and capable of detecting host-based intrusion in their early phase. We evaluate threaTrace on three public datasets. The results show that threaTrace outperforms three state-of-the-art host intrusion detection systems.

Key facts. Cited by 22 papers in the map (data through 7 Oct 2026). Builds on 18 of its 54 references that are in the map. First posted on arXiv 8 Nov 2021.

Builds on

18 of 54 references.

References · 18

  1. 2017Inductive Representation Learning on Large Graphscited by 6,284
  2. 2018Adversarial Attacks on Neural Networks for Graph Datacited by 395
  3. 2018Graph Convolutional Networks for Text Classificationcited by 345
  4. 2018Adversarial Attack and Defense on Graph Data: A Surveycited by 166
  5. 2020Graph Backdoorcited by 112
  6. 2020Retrosynthesis Prediction with Conditional Graph Logic Networkcited by 103
  7. 2019Learning the Graphical Structure of Electronic Health Records with Graph Convolutional Transformercited by 88
  8. 2019Transferring Robustness for Graph Neural Network Against Poisoning Attackscited by 58
  9. 2019Attacking Graph-based Classification via Manipulating the Graph Structurecited by 53
  10. 2020UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threatscited by 53
  11. 2018Deep Reasoning with Knowledge Graph for Social Relationship Understandingcited by 44
  12. 2018HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flowscited by 43
6 more
  1. 2016Fast Memory-efficient Anomaly Detection in Streaming Heterogeneous Graphscited by 37
  2. 2018SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Datacited by 28
  3. 2018Semi-supervised User Geolocation via Graph Convolutional Networkscited by 27
  4. 2019POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Huntingcited by 27
  5. 2017Practical Whole-System Provenance Capturecited by 19
  6. 2019Power up! Robust Graph Convolutional Network via Graph Poweringcited by 15

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 3; 2024: 5; 2025: 6; 2026: 8.

22 papers.

Sort:

By area:

  1. 2023Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenancecited by 30
  2. 2023MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learningcited by 20
  3. 2025SoK: Trust-Authorization Mismatch in LLM Agent Interactionscited by 11
  4. 2024LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detectioncited by 8
  5. 2024Use of Graph Neural Networks in Aiding Defensive Cyber Operationscited by 7
  6. 2024TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learningcited by 6
  7. 2025OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMscited by 6
  8. 2025OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Promptingcited by 3
  9. 2025Deep Learning-based Intrusion Detection Systems: A Surveycited by 2
  10. 2026Benchmarking and Exploring the Capabilities of LLMs for Attack Investigationscited by 2
  11. 2023GNNBleed: Inference Attacks to Unveil Private Edges in Graphs with Realistic Access to GNN Modelscited by 1
  12. 2026PIDSMaker: Building and Evaluating Provenance-based Intrusion Detection Systemscited by 1
10 more
  1. 2026HIDBench: Benchmarking Large Language Models for Host-Based Intrusion Detectioncited by 1
  2. 2024Problem space structural adversarial attacks for Network Intrusion Detection Systems based on Graph Neural Networkscited by 0
  3. 2024RAPID: Robust APT Detection and Investigation Using Context-Aware Deep Learningcited by 0
  4. 2025CONTINUUM: Detecting APT Attacks through Spatial-Temporal Graph Neural Networkscited by 0
  5. 2025Modeling Behavioral Preferences of Cyber Adversaries Using Inverse Reinforcement Learningcited by 0
  6. 2026GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classificationcited by 0
  7. 2026NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewritingcited by 0
  8. 2026Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agentscited by 0
  9. 2026How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detectioncited by 0
  10. 2026Not All Relations Are Equal: Relation-Balanced and Calibrated Graph Learning for Provenance-Based Intrusion Detectioncited by 0