Threat Detection

2025

1. Infocom

   A Principled Approach for Detecting APTs in Massive Networks via Multi-Stage Causal Analytics

   Jiaping Gui, Mingjie Nie, Jinyao Guo, Futai Zou, Mati Ur Rehman, and Wajih Ul Hassan

   In IEEE INFOCOM, 2025

   Abstract Bib PDF

   Detecting Advanced Persistent Threats (APTs) in large enterprise networks with conventional Network Intrusion Detection Systems (NIDS) is challenging due to the stealthy, multi-stage, and long-running nature of APTs. This paper introduces NETGUARDIAN, a novel NIDS utilizing a comprehensive methodology to correlate anomalies across APT stages. By merging real traffic with simulated APT scenarios, NETGUARDIAN creates a detailed training dataset for enhanced anomaly detection. NETGUARDIAN implements custom models for each APT stage, extracting specific traffic features, such as periodicity and failed connections, to identify anomalies. These anomalies are then correlated to reconstruct attack paths. Our system leverages these paths to assign threat scores based on interconnected anomalies matching known APT progression, effectively prioritizing suspicious paths. Evaluation on a large dataset of enterprise network traffic merged with simulated APTs along with the DARPA OpTC dataset shows that NETGUARDIAN detects various APT stages with high accuracy and low false positives, outperforming state-of-the-art (SOTA) NIDS.

   @inproceedings{gui2025principled,
     title = {A Principled Approach for Detecting APTs in Massive Networks via Multi-Stage Causal Analytics},
     author = {Gui, Jiaping and Nie, Mingjie and Guo, Jinyao and Zou, Futai and Rehman, Mati Ur and Hassan, Wajih Ul},
     booktitle = {IEEE INFOCOM},
     year = {2025},
     doi = {10.1109/infocom55648.2025.11044565}
   }

2024

1. Oakland

   FLASH: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning

   Mati Ur Rehman, Hadi Ahmadi, and Wajih Ul Hassan

   In IEEE Symposium on Security and Privacy (S&P), 2024

   Abstract Bib PDF

   Recently, provenance-based Intrusion Detection Systems (IDSes) have gained popularity for their potential in detecting sophisticated Advanced Persistent Threat (APT) attacks. These IDSes employ provenance graphs created from system logs to identify potentially malicious activities. Despite their potential, they face challenges in accuracy, practicality, and scalability, particularly when dealing with large provenance graphs. We present Flash, a scalable IDS that leverages graph representation learning through Graph Neural Networks (GNNs) on data provenance graphs to overcome these limitations. Flash employs a Word2Vec-based semantic encoder to capture essential semantic attributes (e.g., process names and file paths) and the temporal ordering of events within the provenance graph. Furthermore, Flash incorporates a novel adaptation of a GNN-based contextual encoder to efficiently encode both local and global graph structures into expressive node embeddings. To learn benign node behaviors, we utilize a lightweight classifier that combines the GNN and Word2Vec embeddings. Recognizing the computational demands and slow processing times of GNN, particularly for large provenance graphs, we have developed an embedding recycling database to store the node embeddings generated during the training phase. During runtime, our lightweight classifier leverages the stored embeddings, obviating the need to regenerate GNN embeddings, thus facilitating real-time APT detection. Extensive evaluation of Flash on real-world datasets demonstrates superior detection accuracy compared to existing provenance-based IDSes. The results also illustrate Flash’s scalability, robustness against mimicry attacks, and potential for accelerating the alert verification process.

   @inproceedings{flash2024,
     title = {FLASH: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning},
     author = {Rehman, Mati Ur and Ahmadi, Hadi and Hassan, Wajih Ul},
     booktitle = {IEEE Symposium on Security and Privacy (S\&P)},
     year = {2024},
     doi = {10.1109/sp54263.2024.00139}
   }

2020

1. NDSS

   You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis.

   Qi Wang, Wajih Ul Hassan, Ding Li, Kangkook Jee, Xiao Yu, Kexuan Zou, Junghwan Rhee, Zhengzhang Chen, and 3 more authors

   In Symposium on Network and Distributed System Security (NDSS), 2020

   Abstract Bib PDF

   To subvert recent advances in perimeter and host security, the attacker community has developed and employed various attack vectors to make a malware much stealthier than before to penetrate the target system and prolong its presence. Such advanced malware or "stealthy malware" makes use of various techniques to impersonate or abuse benign applications and legitimate system tools to minimize its footprints in the target system. It is thus difficult for traditional detection tools, such as malware scanners, to detect it, as the malware normally does not expose its malicious payload in a file and hides its malicious behaviors among the benign behaviors of the processes. In this paper, we present PROVDETECTOR, a provenancebased approach for detecting stealthy malware. Our insight behind the PROVDETECTOR approach is that although a stealthy malware attempts to blend into benign processes, its malicious behaviors inevitably interact with the underlying operating system (OS), which will be exposed to and captured by provenance monitoring. Based on this intuition, PROVDETECTOR first employs a novel selection algorithm to identify possibly malicious parts in the OS-level provenance data of a process. It then applies a neural embedding and machine learning pipeline to automatically detect any behavior that deviates significantly from normal behaviors. We evaluate our approach on a large provenance dataset from an enterprise network and demonstrate that it achieves very high detection performance of stealthy malware (an average F1 score of 0.974).Further, we conduct thorough interpretability studies to understand the internals of the learned machine learning models.

   @inproceedings{provdetector2020,
     title = {You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis.},
     author = {Wang, Qi and Hassan, Wajih Ul and Li, Ding and Jee, Kangkook and Yu, Xiao and Zou, Kexuan and Rhee, Junghwan and Chen, Zhengzhang and Cheng, Wei and Gunter, Carl A and Chen, Haifeng},
     year = {2020},
     booktitle = {Symposium on Network and Distributed System Security (NDSS)},
     doi = {10.14722/ndss.2020.24167}
   }

2. Oakland

   Tactical Provenance Analysis for Endpoint Detection and Response Systems

   Wajih Ul Hassan, Adam Bates, and Daniel Marino

   In IEEE Symposium on Security and Privacy (S&P), 2020

   Abstract Bib PDF

   Endpoint Detection and Response (EDR) tools provide visibility into sophisticated intrusions by matching system events against known adversarial behaviors. However, current solutions suffer from three challenges: 1) EDR tools generate a high volume of false alarms, creating backlogs of investigation tasks for analysts; 2) determining the veracity of these threat alerts requires tedious manual labor due to the overwhelming amount of low-level system logs, creating a "needle-in-a-haystack" problem; and 3) due to the tremendous resource burden of log retention, in practice the system logs describing long-lived attack campaigns are often deleted before an investigation is ever initiated. This paper describes an effort to bring the benefits of data provenance to commercial EDR tools. We introduce the notion of Tactical Provenance Graphs (TPGs) that, rather than encoding low-level system event dependencies, reason about causal dependencies between EDR-generated threat alerts. TPGs provide compact visualization of multi-stage attacks to analysts, accelerating investigation. To address EDR’s false alarm problem, we introduce a threat scoring methodology that assesses risk based on the temporal ordering between individual threat alerts present in the TPG. In contrast to the retention of unwieldy system logs, we maintain a minimally-sufficient skeleton graph that can provide linkability between existing and future threat alerts. We evaluate our system, RapSheet, using the Symantec EDR tool in an enterprise environment. Results show that our approach can rank truly malicious TPGs higher than false alarm TPGs. Moreover, our skeleton graph reduces the long-term burden of log retention by up to 87%.

   @inproceedings{rapsheet2020,
     title = {Tactical Provenance Analysis for Endpoint Detection and Response Systems},
     author = {Hassan, Wajih Ul and Bates, Adam and Marino, Daniel},
     year = {2020},
     booktitle = {IEEE Symposium on Security and Privacy (S\&P)},
     doi = {10.1109/sp40000.2020.00096}
   }

2019

1. Oakland

   Can data provenance put an end to the data breach?

   Adam Bates, and Wajih Ul Hassan

   IEEE Symposium on Security and Privacy (S&P), 2019

   Abstract Bib PDF

   In September 2017, the world awoke to the news that Equifax, a consumer reporting agency and one of the pillars of the American credit system, fell prey to a data breach that led to the exposure of 147 million individuals’ personal information. For Equifax, the coming weeks would include high-profile executive resignations, a steep drop in its stock prices, and an infamously ill-conceived public outreach effort; however, eventually the public’s attention turned elsewhere. After all, Equifax was just the latest in a seemingly endless parade of data breach victims that included commercial titans like Target and eBay, political campaigns like Hillary Clinton’s, and government agencies like the Office of Personnel Management. Today, the threat of the next data breach looms invisibly over every aspect of society.

   @article{magazine2019,
     title = {Can data provenance put an end to the data breach?},
     author = {Bates, Adam and Hassan, Wajih Ul},
     year = {2019},
     journal = {IEEE Symposium on Security and Privacy (S\&P)},
     volume = {17},
     doi = {10.1109/msec.2019.2913693}
   }