Search papers, labs, and topics across Lattice.
This paper introduces PROVFUSION, a multi-view intrusion detection framework that fuses anomaly signals from node attributes, graph structure, and causal relationships within system provenance graphs. By integrating these heterogeneous signals through lightweight fusion schemes and a voting-based decision process, PROVFUSION overcomes the limitations of node-centric and edge-centric approaches which often miss subtle anomalies. Experiments on nine benchmark datasets demonstrate that PROVFUSION achieves higher detection accuracy and lower false-positive rates compared to single-view baselines.
Fusing node-centric and edge-centric views of system provenance graphs slashes false positives in intrusion detection, outperforming single-view methods on standard benchmarks.
Provenance-based intrusion detection has emerged as a promising approach for analyzing complex attack behaviors through system-level provenance graphs. However, existing defense methods face an inherent granularity limitation. Node-centric detectors, which evaluate anomalies using entities'attributes and local structural patterns, may misclassify benign behavioral changes or configuration modifications as suspicious. In contrast, edge-centric detectors, which focus more on interactions, may lack sufficient contextual awareness of the involved entities, leading to missed detections when compromised entities perform seemingly ordinary operations. These analytical biases highlight a persistent gap between node-centric and edge-centric analyses. To mitigate this gap, we present PROVFUSION, a multi-view detection framework that integrates anomaly signals from three distinct views (i.e., attribute, structure, and causality). The framework fuses heterogeneous anomaly signals through lightweight fusion schemes and determines the final anomaly decisions through a voting-based integration process, providing a more consistent and context-aware assessment of system behavior. This design enables PROVFUSION to capture both entity level deviations and interaction-level anomalies within a consistent analytic pipeline. Experiments on nine widely used benchmark datasets demonstrate that PROVFUSION achieves higher detection accuracy and lower false-positive rates than single node- and edge-centric baselines, maintaining stable performance across scenarios. Overall, the results suggest that our multi-view anomaly fusion together with voting-based decision aggregation offers a practical and effective direction for advancing provenance-based intrusion detection.
