Reducing False Positives in Provenance-Based Intrusion Detection Systems

Summary

SheepHunter is a method that reduces false positives in provenance-based intrusion detection systems (PIDSes), which flag anomalous processes but cannot tell abnormal processes from benign ones with unfamiliar patterns. It represents processes as high-dimensional embedding vectors built from execution context, access control attributes and provenance-graph structure, then classifies processes with high behavior density across dimensions, measured by a community splitting algorithm, as false positives. On two open-source datasets, it reduced false positives by an average of 43.8% for existing PIDSes.