Beyond Nodes vs. Edges: A Multi-View Fusion Framework for Provenance-Based Intrusion Detection

• URL: http://arxiv.org/abs/2604.14685v1
• Date: Thu, 16 Apr 2026 06:40:50 GMT
• Title: Beyond Nodes vs. Edges: A Multi-View Fusion Framework for Provenance-Based Intrusion Detection
• Abstract summary: PROVfusion is a multi-view anomaly fusion framework for provenance-based intrusion detection.<n>It fuses heterogeneous anomaly signals through lightweight fusion schemes and determines the final anomaly decisions through a voting-based integration process.<n>Experiments on nine widely used benchmark entity datasets demonstrate that PROVfusion achieves higher detection accuracy and lower false-positive rates than single node- and edge-centric baselines.
• Score: 6.343815622517112
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Provenance-based intrusion detection has emerged as a promising approach for analyzing complex attack behaviors through system-level provenance graphs. However, existing defense methods face an inherent granularity limitation. Node-centric detectors, which evaluate anomalies using entities' attributes and local structural patterns, may misclassify benign behavioral changes or configuration modifications as suspicious. In contrast, edge-centric detectors, which focus more on interactions, may lack sufficient contextual awareness of the involved entities, leading to missed detections when compromised entities perform seemingly ordinary operations. These analytical biases highlight a persistent gap between node-centric and edge-centric analyses. To mitigate this gap, we present PROVFUSION, a multi-view detection framework that integrates anomaly signals from three distinct views (i.e., attribute, structure, and causality). The framework fuses heterogeneous anomaly signals through lightweight fusion schemes and determines the final anomaly decisions through a voting-based integration process, providing a more consistent and context-aware assessment of system behavior. This design enables PROVFUSION to capture both entity level deviations and interaction-level anomalies within a consistent analytic pipeline. Experiments on nine widely used benchmark datasets demonstrate that PROVFUSION achieves higher detection accuracy and lower false-positive rates than single node- and edge-centric baselines, maintaining stable performance across scenarios. Overall, the results suggest that our multi-view anomaly fusion together with voting-based decision aggregation offers a practical and effective direction for advancing provenance-based intrusion detection.

Related papers

• XMatchAD: A Cross-Modal Matching Perspective on Reconstruction-based Anomaly Detection [30.401044523780723]
  XMatchAD is a novel UAD framework that reinterprets the task from a pseudo cross-modal matching perspective.<n>Our method consistently achieves superior performance, outperforming state-of-the-art methods in multi-class anomaly detection and localization.
  arXiv  Detail & Related papers  (2026-07-26T13:47:10Z)
• Hierarchical Reference Sets for Robust Unsupervised Detection of Scattered and Clustered Outliers [8.21087649188741]
  Clustered outliers can be easily mistaken for normal behavior because of their relatively high local density.<n>We propose a novel outlier detection paradigm that leverages the natural neighboring relationships using graph structures.<n>Our approach enables the effective recognition of scattered outliers without interference from clustered anomalies.
  arXiv  Detail & Related papers  (2026-03-13T09:48:20Z)
• Noise & pattern: identity-anchored Tikhonov regularization for robust structural anomaly detection [58.535473924035365]
  Anomaly detection plays a pivotal role in automated industrial inspection, aiming to identify subtle or rare defects in otherwise uniform visual patterns.<n>We tackle structural anomaly detection using a self-supervised autoencoder that learns to repair corrupted inputs.<n>We introduce a corruption model that injects artificial disruptions into training images to mimic structural defects.
  arXiv  Detail & Related papers  (2025-11-10T15:48:50Z)
• Registration is a Powerful Rotation-Invariance Learner for 3D Anomaly Detection [64.0168648353038]
  3D anomaly detection in point-cloud data is critical for industrial quality control, aiming to identify structural defects with high reliability.<n>Current memory bank-based methods often suffer from inconsistent feature transformations and limited discriminative capacity.<n>We propose a registration-induced, rotation-invariant feature extraction framework that integrates the objectives of point-cloud registration and memory-based anomaly detection.
  arXiv  Detail & Related papers  (2025-10-19T14:56:38Z)
• GTHNA: Local-global Graph Transformer with Memory Reconstruction for Holistic Node Anomaly Evaluation [7.287914649294607]
  Anomaly detection in graph-structured data is an inherently challenging problem.<n>Existing methods, such as those based on graph convolutional networks (GCNs), often suffer from over-smoothing.<n>We propose a novel and holistic anomaly evaluation framework that integrates three key components.
  arXiv  Detail & Related papers  (2025-09-13T15:52:16Z)
• Fair Deepfake Detectors Can Generalize [51.21167546843708]
  We show that controlling for confounders (data distribution and model capacity) enables improved generalization via fairness interventions.<n>Motivated by this insight, we propose Demographic Attribute-insensitive Intervention Detection (DAID), a plug-and-play framework composed of: i) Demographic-aware data rebalancing, which employs inverse-propensity weighting and subgroup-wise feature normalization to neutralize distributional biases; and ii) Demographic-agnostic feature aggregation, which uses a novel alignment loss to suppress sensitive-attribute signals.<n>DAID consistently achieves superior performance in both fairness and generalization compared to several state-of-the-art
  arXiv  Detail & Related papers  (2025-07-03T14:10:02Z)
• OoDDINO:A Multi-level Framework for Anomaly Segmentation on Complex Road Scenes [3.0743391441996684]
  Anomaly segmentation aims to identify Out-of-Distribution (OoD) anomalous objects within images.<n>Existing pixel-wise methods typically assign anomaly scores individually and employ a global thresholding strategy to segment anomalies.<n>We introduce OoDDINO, a novel multi-level anomaly segmentation framework designed to address these limitations.
  arXiv  Detail & Related papers  (2025-07-02T08:15:11Z)
• Rethinking Contrastive Learning in Graph Anomaly Detection: A Clean-View Perspective [54.605073936695575]
  Graph anomaly detection aims to identify unusual patterns in graph-based data, with wide applications in fields such as web security and financial fraud detection.<n>Existing methods rely on contrastive learning, assuming that a lower similarity between a node and its local subgraph indicates abnormality.<n>The presence of interfering edges invalidates this assumption, since it introduces disruptive noise that compromises the contrastive learning process.<n>We propose a Clean-View Enhanced Graph Anomaly Detection framework (CVGAD), which includes a multi-scale anomaly awareness module to identify key sources of interference in the contrastive learning process.
  arXiv  Detail & Related papers  (2025-05-23T15:05:56Z)
• Towards Training-free Anomaly Detection with Vision and Language Foundation Models [17.991678161890174]
  Anomaly detection is valuable for real-world applications, such as industrial quality inspection.<n>We introduce LogSAD, a novel multi-modal framework that requires no training for both Logical and Structural Anomaly Detection.
  arXiv  Detail & Related papers  (2025-03-24T04:07:59Z)
• GeneralAD: Anomaly Detection Across Domains by Attending to Distorted Features [68.14842693208465]
  GeneralAD is an anomaly detection framework designed to operate in semantic, near-distribution, and industrial settings. We propose a novel self-supervised anomaly generation module that employs straightforward operations like noise addition and shuffling to patch features. We extensively evaluated our approach on ten datasets, achieving state-of-the-art results in six and on-par performance in the remaining.
  arXiv  Detail & Related papers  (2024-07-17T09:27:41Z)
• Don't Miss Out on Novelty: Importance of Novel Features for Deep Anomaly Detection [64.21963650519312]
  Anomaly Detection (AD) is a critical task that involves identifying observations that do not conform to a learned model of normality. We propose a novel approach to AD using explainability to capture such novel features as unexplained observations in the input space. Our approach establishes a new state-of-the-art across multiple benchmarks, handling diverse anomaly types.
  arXiv  Detail & Related papers  (2023-10-01T21:24:05Z)
• Exploring Robustness of Unsupervised Domain Adaptation in Semantic Segmentation [74.05906222376608]
  We propose adversarial self-supervision UDA (or ASSUDA) that maximizes the agreement between clean images and their adversarial examples by a contrastive loss in the output space. This paper is rooted in two observations: (i) the robustness of UDA methods in semantic segmentation remains unexplored, which pose a security concern in this field; and (ii) although commonly used self-supervision (e.g., rotation and jigsaw) benefits image tasks such as classification and recognition, they fail to provide the critical supervision signals that could learn discriminative representation for segmentation tasks.
  arXiv  Detail & Related papers  (2021-05-23T01:50:44Z)
• Pixel-wise Anomaly Detection in Complex Driving Scenes [30.884375526254836]
  We present a pixel-wise anomaly detection framework that uses uncertainty maps to improve anomaly detection. Our approach works as a general framework around already trained segmentation networks. Top-2 performance across a range of different anomaly datasets shows the robustness of our approach to handling different anomaly instances.
  arXiv  Detail & Related papers  (2021-03-09T14:26:20Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.