APT (Advanced Persistent Threat) with the characteristics of persistence,
stealth, and diversity is one of the greatest threats against
cyber-infrastructure. As a countermeasure, existing studies leverage provenance
graphs to capture the complex relations between system entities in a host for
effective APT detection. In addition to detecting single attack events as most
existing work does, understanding the tactics / techniques (e.g., Kill-Chain,
ATT&CK) applied to organize and accomplish the APT attack campaign is more
important for security operations. Existing studies try to manually design a
set of rules to map low-level system events to high-level APT tactics /
techniques. However, the rule based methods are coarse-grained and lack
generalization ability, thus they can only recognize APT tactics and cannot
identify fine-grained APT techniques and mutant APT attacks. In this paper, we
propose TREC, the first attempt to recognize APT tactics / techniques from
provenance graphs by exploiting deep learning techniques. To address the
"needle in a haystack" problem, TREC segments small and compact subgraphs
covering individual APT technique instances from a large provenance graph based
on a malicious node detection model and a subgraph sampling algorithm. To
address the "training sample scarcity" problem, TREC trains the APT tactic /
technique recognition model in a few-shot learning manner by adopting a Siamese
neural network. We evaluate TREC based on a customized dataset collected and
made public by our team. The experiment results show that TREC significantly
outperforms state-of-the-art systems in APT tactic recognition and TREC can
also effectively identify APT techniques.

本文提出了 TREC 方法，通过利用深度学习技术从溯源图中识别 APT 战术 / 技术，以解决现有方法中粗粒度、缺乏泛化能力的问题，实验结果表明 TREC 在 APT 战术识别方面明显优于现有系统，同时也能有效地识别 APT 技术。

TREC：利用少样本来源子图学习进行 APT 技巧识别

TREC: APT Tactic / Technique Recognition via Few-Shot Provenance  Subgraph Learning

We introduce a new unsupervised pre-training method for reinforcement
learning called APT, which stands for Active Pre-Training. APT learns behaviors
and representations by actively searching for novel states in reward-free
environments. The key novel idea is to explore the environment by maximizing a
non-parametric entropy computed in an abstract representation space, which
avoids challenging density modeling and consequently allows our approach to
scale much better in environments that have high-dimensional observations
(e.g., image observations). We empirically evaluate APT by exposing
task-specific reward after a long unsupervised pre-training phase. In Atari
games, APT achieves human-level performance on 12 games and obtains highly
competitive performance compared to canonical fully supervised RL algorithms.
On DMControl suite, APT beats all baselines in terms of asymptotic performance
and data efficiency and dramatically improves performance on tasks that are
extremely difficult to train from scratch.

通过在非有奖励的环境中最大化抽象表示空间中的非参数熵，APT 探索了环境，从而避免了具有挑战性的密度建模，并且在具有高维观察的环境中表现出色。在 Atari 游戏中，APT 在 12 种游戏上取得人类水平的性能，并且相对于经典的全监督 RL 算法具有高竞争性的表现。在 DMControl 套件中，APT 在渐进性能和数据效率方面击败了所有基线，并显着提高了初学者难以从头开始培训的任务性能。

虚空中的行为：无监督主动预训练

Behavior From the Void: Unsupervised Active Pre-Training

We compare the performance of the APT and AutoPRF metrics for pronoun
translation against a manually annotated dataset comprising human judgements as
to the correctness of translations of the PROTEST test suite. Although there is
some correlation with the human judgements, a range of issues limit the
performance of the automated metrics. Instead, we recommend the use of
semi-automatic metrics and test suites in place of fully automatic metrics.

我们比较了 APT 和 AutoPRF 指标在代词翻译方面的性能，并将其与人工标注的数据集进行了比较。虽然与人工判断存在一定的相关性，但多种问题限制了自动指标的性能。因此，我们建议使用半自动的指标和测试套件代替完全自动的指标。