# DUPIN: Attack Learning Is Still Needed! Demonstrating Few-Shot after Unsupervised Pretraining Is A Nimble Forensics Learner

arXiv: https://arxiv.org/abs/2609.00259 · HTML: https://mlsanity.com/paper/2609.00259/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 31 Aug 2026.

## Built on by (most cited first, 1 of 1)

- [APTInvestBench: Evaluating Autonomous APT Investigation under Varying Telemetry](https://mlsanity.com/paper/2609.38954/) (2026)

## Abstract (arXiv)

We propose a novel approach to learning-based attack forensics called DUPIN. DUPIN performs unsupervised pre-training on an enormous amount of audit events in the form of provenance graphs. It then proceeds to a few-shot learning stage, leveraging a small number of labeled attack examples to fine-tune its detection capabilities. We pretrain DUPIN on up to 38 - 52 days of audit logs (7.3TB total) and evaluate it against various baselines on 25 APT campaigns across four different data sources, facilitating the scalable evaluation.