Advanced persistent threats (APTs) pose significant challenges for
organizations, leading to data breaches, financial losses, and reputational
damage. Existing provenance-based approaches for APT detection often struggle
with high false positive rates, a lack of interpretability, and an inability to
adapt to evolving system behavior. We introduce RAPID, a novel deep
learning-based method for robust APT detection and investigation, leveraging
context-aware anomaly detection and alert tracing. By utilizing self-supervised
sequence learning and iteratively learned embeddings, our approach effectively
adapts to dynamic system behavior. The use of provenance tracing both enriches
the alerts and enhances the detection capabilities of our approach. Our
extensive evaluation demonstrates RAPID's effectiveness and computational
efficiency in real-world scenarios. In addition, RAPID achieves higher
precision and recall than state-of-the-art methods, significantly reducing
false positives. RAPID integrates contextual information and facilitates a
smooth transition from detection to investigation, providing security teams
with detailed insights to efficiently address APT threats.

RAPID 是一种基于深度学习的新型方法，利用上下文感知异常检测和警报追踪来实现强大的高级持续性威胁（APTs）检测和调查，通过利用自我监督的序列学习和迭代学习的嵌入，我们的方法能够有效应对动态系统行为，并且通过使用溯源跟踪，丰富警报信息和提高检测能力，RAPID 在真实场景中证明了其有效性和计算效率，同时相比最先进的方法具有更高的精确度和召回率，显著减少误报，RAPID 整合上下文信息，便于从检测过渡到调查，为安全团队提供详细的见解以高效应对 APTs 威胁。