# ANUBIS: A Provenance Graph-Based Framework for Advanced Persistent Threat Detection

arXiv: https://arxiv.org/abs/2112.11032 · HTML: https://mlsanity.com/paper/2112.11032/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 46 references that are in the map.
- First posted on arXiv 21 Dec 2021.

## Builds on (most cited first, 13 of 13)

- [Graph-based Anomaly Detection and Description: A Survey](https://mlsanity.com/paper/1404.4679/) (2014)
- [UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats](https://mlsanity.com/paper/2001.01525/) (2020)
- [HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flows](https://mlsanity.com/paper/1810.01594/) (2018)
- [Fast Memory-efficient Anomaly Detection in Streaming Heterogeneous Graphs](https://mlsanity.com/paper/1602.04844/) (2016)
- [SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data](https://mlsanity.com/paper/1801.02062/) (2018)
- [POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting](https://mlsanity.com/paper/1910.00056/) (2019)
- [Practical Whole-System Provenance Capture](https://mlsanity.com/paper/1711.05296/) (2017)
- [SK-Tree: a systematic malware detection algorithm on streaming trees via the signature kernel](https://mlsanity.com/paper/2102.07904/) (2021)
- [Analyzing the Usefulness of the DARPA OpTC Dataset in Cyber Threat Detection Research](https://mlsanity.com/paper/2103.03080/) (2021)
- [SAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detection](https://mlsanity.com/paper/1806.09339/) (2018)
- [Early detection of the advanced persistent threat attack using performance analysis of deep learning](https://mlsanity.com/paper/2009.10524/) (2020)
- [FRAPpuccino: Fault-detection through Runtime Analysis of Provenance](https://mlsanity.com/paper/1711.11487/) (2017)
- [ProPatrol: Attack Investigation via Extracted High-Level Tasks](https://mlsanity.com/paper/1810.05711/) (2018)

## Built on by (most cited first, 3 of 3)

- [Deep Learning-based Intrusion Detection Systems: A Survey](https://mlsanity.com/paper/2504.07839/) (2025)
- [CyberGFM: Graph Foundation Models for Lateral Movement Detection in Enterprise Networks](https://mlsanity.com/paper/2601.05988/) (2026)
- [LogShield: A Transformer-based APT Detection System Leveraging Self-Attention](https://mlsanity.com/paper/2311.05733/) (2023)

## Abstract (arXiv)

We present ANUBIS, a highly effective machine learning-based APT detection system. Our design philosophy for ANUBIS involves two principal components. Firstly, we intend ANUBIS to be effectively utilized by cyber-response teams. Therefore, prediction explainability is one of the main focuses of ANUBIS design. Secondly, ANUBIS uses system provenance graphs to capture causality and thereby achieve high detection performance. At the core of the predictive capability of ANUBIS, there is a Bayesian Neural Network that can tell how confident it is in its predictions. We evaluate ANUBIS against a recent APT dataset (DARPA OpTC) and show that ANUBIS can detect malicious activity akin to APT campaigns with high accuracy. Moreover, ANUBIS learns about high-level patterns that allow it to explain its predictions to threat analysts. The high predictive performance with explainable attack story reconstruction makes ANUBIS an effective tool to use for enterprise cyber defense.