METANOIA: A Lifelong Intrusion Detection and Investigation System for Mitigating Concept Drift
Ruoxi Chen Jie Ying Zhongjie Zhua Mengce Zheng Jungan Chen Tiantian Zhu
作者信息
Abstract
As Advanced Persistent Threat (APT) complexity increases, provenance data is increasingly used for detection. Anomaly-based systems are gaining attention due to their attack-knowledge-agnostic nature and ability to counter zero-day vulnerabilities. However, traditional detection paradigms, which train on offline, limited-size data, often overlook concept drift - unpredictable changes in streaming data distribution over time. This leads to high false positive rates. We propose incremental learning as a new paradigm to mitigate this issue. However, we identify FOUR CHALLENGES while integrating incremental learning as a new paradigm. First, the long-running incremental system must combat catastrophic forgetting (C1) and avoid learning malicious behaviors (C2). Then, the system needs to achieve precise alerts (C3) and reconstruct attack scenarios (C4). We present METANOIA, the first lifelong detection system that mitigates the high false positives due to concept drift. It connects pseudo edges to combat catastrophic forgetting, transfers suspicious states to avoid learning malicious behaviors, filters nodes at the path-level to achieve precise alerts, and constructs mini-graphs to reconstruct attack scenarios. Using state-of-the-art benchmarks, we demonstrate that METANOIA improves precision performance at the window-level, graph-level, and node-level by 30%, 54%, and 29%, respectively, compared to previous approaches.引用本文复制引用
Ruoxi Chen,Jie Ying,Zhongjie Zhua,Mengce Zheng,Jungan Chen,Tiantian Zhu.METANOIA: A Lifelong Intrusion Detection and Investigation System for Mitigating Concept Drift[EB/OL].(2026-03-17)[2026-04-02].https://arxiv.org/abs/2501.00438.学科分类
计算技术、计算机技术
|国家预印本平台
评论