Ppin: Anomaly-Based Intrusion Detection on Provenance Graph via Behavior Pattern Mining

Ppin is an anomaly-based intrusion detection system that uses provenance graphs (visual maps showing how different parts of a computer system interact with each other) to identify attacks by finding unusual patterns in system behavior. Unlike existing systems that struggle to explain attacks clearly, Ppin uses a memory-augmented neural network (a machine learning model that remembers information over time) to detect rare behaviors and correlate them to show the full story of how an attack happened.