Ppin: Anomaly-Based Intrusion Detection on Provenance Graph via Behavior Pattern Mining

Summary

Ppin is an anomaly-based intrusion detection system that operates on provenance graphs, which model relationships between system entities. It uses a memory-augmented neural network to model processes against learnable latent categories, then abstracts rare entities into behavior patterns and correlates them by causal dependency to produce alerts that reconstruct an attack narrative. The authors report that Ppin outperforms state-of-the-art systems in node-level detection and produces contextual alerts.