Advanced persistent threats (APT) are stealthy cyber-attacks that are aimed
at stealing valuable information from target organizations and tend to extend
in time. Blocking all APTs is impossible, security experts caution, hence the
importance of research on early detection and damage limitation. Whole-system
provenance-tracking and provenance trace mining are considered promising as
they can help find causal relationships between activities and flag suspicious
event sequences as they occur. We introduce an unsupervised method that
exploits OS-independent features reflecting process activity to detect
realistic APT-like attacks from provenance traces. Anomalous processes are
ranked using both frequent and rare event associations learned from traces.
Results are then presented as implications which, since interpretable, help
leverage causality in explaining the detected anomalies. When evaluated on
Transparent Computing program datasets (DARPA), our method outperformed
competing approaches.

该论文介绍了一种利用与操作系统无关的特征来检测真实的高级持续性威胁攻击的无监督方法，并利用可解释性的结果来揭示被检测到的异常，这有助于解释因果关系。在 DARPA 的测试数据集中，该方法的表现优于竞争方法。