{"data":{"id":"b9e30ac4-b71a-41a4-b270-83aad3e95a13","title":"Ppin: Anomaly-Based Intrusion Detection on Provenance Graph via Behavior Pattern Mining","summary":"Ppin is an anomaly-based intrusion detection system that uses provenance graphs (visual maps showing how different parts of a computer system interact with each other) to identify attacks by finding unusual patterns in system behavior. Unlike existing systems that struggle to explain attacks clearly, Ppin uses a memory-augmented neural network (a machine learning model that remembers information over time) to detect rare behaviors and correlate them to show the full story of how an attack happened.","solution":"N/A -- no mitigation discussed in source.","labels":["research","security"],"sourceUrl":"http://ieeexplore.ieee.org/document/11594958","publishedAt":"2026-07-03T13:23:36.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":[],"issueType":"research","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":[],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-07-03T13:23:36.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.75,"researchCategory":"peer_reviewed","atlasIds":null}}