An End-to-End Framework for Functionality-Embedded Provenance Graph Construction and Threat Interpretation

• URL: http://arxiv.org/abs/2603.17100v1
• Date: Tue, 17 Mar 2026 19:40:05 GMT
• Title: An End-to-End Framework for Functionality-Embedded Provenance Graph Construction and Threat Interpretation
• Abstract summary: Auto-Prov is an end-to-end framework for provenance graph-based anomaly detectors.<n>It clusters unseen log types and efficiently extracts provenance edges and entity-level information.<n>It infers system-level functional context for both known and previously unseen system entities.<n>It produces stable, interpretable attack summaries that remain robust under system evolution.
• Score: 2.0740117800511215
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Provenance graphs model causal system-level interactions from logs, enabling anomaly detectors to learn normal behavior and detect deviations as attacks. However, existing approaches rely on brittle, manually engineered rules to build provenance graphs, lack functional context for system entities, and provide limited support for analyst investigation. We present Auto-Prov, an adaptive, end-to-end framework that leverages large language models (LLMs) to automatically construct provenance graphs from heterogeneous and evolving logs, embed system-level functional attributes into the graph, enable provenance graph-based anomaly detectors to learn from these enriched graphs, and summarize the detected attacks to assist an analyst's investigation. Auto-Prov clusters unseen log types and efficiently extracts provenance edges and entity-level information via automatically generated rules. It further infers system-level functional context for both known and previously unseen system entities using a combination of LLM inference and behavior-based estimation. Attacks detected by provenance-graph-based anomaly detectors trained on Auto-Prov's graphs are then summarized into natural-language text. We evaluate Auto-Prov with four state-of-the-art provenance graph-based detectors across diverse logs. Results show that Auto-Prov consistently enhances detection performance, generalizes across heterogeneous log formats, and produces stable, interpretable attack summaries that remain robust under system evolution.

Related papers

• NeuroTrace: Inference Provenance-Based Detection of Adversarial Examples [1.096626056612224]
  We introduce NeuroTrace, a framework for analyzing inference provenance through Inference Provenance Graphs (IPGs)<n>IPGs are heterogeneous graphs that capture both activation behavior and parameter-induced dataflow during a model's forward pass.<n>We evaluate IPG-based detectors for adversarial example detection under intra-attack, multi-attack, and cross-threat transfer settings.
  arXiv  Detail & Related papers  (2026-04-15T22:23:40Z)
• Explainability-Guided Adversarial Attacks on Transformer-Based Malware Detectors Using Control Flow Graphs [0.19116784879310025]
  This paper examines the vulnerability of a RoBERTa-based malware detector that linearizes control flow graphs into sequences of function calls.<n>By evaluating evasion strategies within this graph-to-sequence framework, we provide insight into the practical robustness of transformer-based malware detectors beyond aggregate detection accuracy.
  arXiv  Detail & Related papers  (2026-04-04T19:50:04Z)
• Learning to Explore: Policy-Guided Outlier Synthesis for Graph Out-of-Distribution Detection [51.93878677594561]
  In unsupervised graph-level OOD detection, models are typically trained using only in-distribution (ID) data.<n>We propose a Policy-Guided Outlier Synthesis framework that replaces statics with a learned exploration strategy.
  arXiv  Detail & Related papers  (2026-02-28T11:40:18Z)
• ContraLog: Log File Anomaly Detection with Contrastive Learning and Masked Language Modeling [5.34230216484876]
  ContraLog is a log anomaly detection method that predicts continuous message embeddings rather than discrete template IDs.<n>We show that message embeddings generated by ContraLog carry meaningful information and are predictive of anomalies even without sequence context.<n>Results highlight embedding-level prediction as an approach for log anomaly detection, with potential applicability to other event sequences.
  arXiv  Detail & Related papers  (2026-02-03T15:59:40Z)
• RPG-AE: Neuro-Symbolic Graph Autoencoders with Rare Pattern Mining for Provenance-Based Anomaly Detection [0.8373057326694192]
  This paper presents a neuro-symbolic anomaly detection framework that combines a Graph Autoencoder with rare pattern mining.<n>Anomaly candidates are identified through deviations between observed and reconstructed graph structure.<n>We evaluate the proposed method on the DARPA Transparent Computing datasets and show that rare-pattern boosting yields substantial gains in anomaly ranking quality.
  arXiv  Detail & Related papers  (2026-02-03T00:02:37Z)
• OWLEYE: Zero-Shot Learner for Cross-Domain Graph Data Anomaly Detection [48.77471686671269]
  OWLEYE is a novel framework that learns transferable patterns of normal behavior from multiple graphs.<n>We show that OWLEYE achieves superior performance and generalizability compared to state-of-the-art baselines.
  arXiv  Detail & Related papers  (2026-01-27T02:08:18Z)
• ADALog: Adaptive Unsupervised Anomaly detection in Logs with Self-attention Masked Language Model [2.55347686868565]
  ADALog is an adaptive, unsupervised anomaly detection framework.<n>It operates on individual unstructured logs, extracts intra-log contextual relationships, and performs adaptive thresholding on normal data.<n>We evaluate ADALog on benchmark datasets BGL, Thunderbird, and Spirit.
  arXiv  Detail & Related papers  (2025-05-15T17:31:40Z)
• Out-of-Distribution Detection on Graphs: A Survey [58.47395497985277]
  Graph out-of-distribution (GOOD) detection focuses on identifying graph data that deviates from the distribution seen during training.<n>We categorize existing methods into four types: enhancement-based, reconstruction-based, information propagation-based, and classification-based approaches.<n>We discuss practical applications and theoretical foundations, highlighting the unique challenges posed by graph data.
  arXiv  Detail & Related papers  (2025-02-12T04:07:12Z)
• GLAD: Content-aware Dynamic Graphs For Log Anomaly Detection [49.9884374409624]
  GLAD is a Graph-based Log Anomaly Detection framework designed to detect anomalies in system logs. We introduce GLAD, a Graph-based Log Anomaly Detection framework designed to detect anomalies in system logs.
  arXiv  Detail & Related papers  (2023-09-12T04:21:30Z)
• Representing Timed Automata and Timing Anomalies of Cyber-Physical Production Systems in Knowledge Graphs [51.98400002538092]
  This paper aims to improve model-based anomaly detection in CPPS by combining the learned timed automaton with a formal knowledge graph about the system. Both the model and the detected anomalies are described in the knowledge graph in order to allow operators an easier interpretation of the model and the detected anomalies.
  arXiv  Detail & Related papers  (2023-08-25T15:25:57Z)
• BOURNE: Bootstrapped Self-supervised Learning Framework for Unified Graph Anomaly Detection [50.26074811655596]
  We propose a novel unified graph anomaly detection framework based on bootstrapped self-supervised learning (named BOURNE) By swapping the context embeddings between nodes and edges, we enable the mutual detection of node and edge anomalies. BOURNE can eliminate the need for negative sampling, thereby enhancing its efficiency in handling large graphs.
  arXiv  Detail & Related papers  (2023-07-28T00:44:57Z)
• Topological Data Analysis for Anomaly Detection in Host-Based Logs [1.0878040851638]
  We present an approach that builds a filtration of simplicial complexes directly from Windows logs, enabling analysis of their intrinsic structure using topological tools. We end by discussing the potential for our methods to be used as part of an explainable framework for anomaly detection.
  arXiv  Detail & Related papers  (2022-04-25T20:41:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.