GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classification

Technical Summary: GRASP - Graph-Based Anomaly Detection Through Self-Supervised Classification

Problem Statement

Advanced Persistent Threat (APT) attacks are increasingly difficult to detect due to their stealth, adaptability, and reliance on "living-off-the-land" (LOTL) techniques, where attackers utilize legitimate system components. While Provenance-based Intrusion Detection Systems (PIDS) offer a promising defense by capturing fine-grained relationships between system components, current solutions face significant limitations:

1. Threshold Dependency: Existing systems rely on predefined or subset-determined thresholds to flag anomalies. This approach limits detection stability, requires manual tuning, and risks data snooping.
2. Neglect of Executables: Many related works overlook the role of process executables, which are primary drivers of system behavior as they interact with files, networks, and other processes.
3. Instability and Reproducibility: Recent state-of-the-art systems (e.g., ORTHRUS, VELOX) exhibit high run-to-run instability and often fail to reproduce results consistently across different runs or dataset splits.
4. Limited Anomaly Coverage: Current methods often filter out "false positives" that may actually represent undocumented attacks or changes in normal behavior, leading to incomplete detection coverage.

Methodology: GRASP

The authors propose GRASP (GRaph-based Anomaly detection through Self-suPervised classification), a PIDS that utilizes masked self-supervised classification on provenance graphs.

• Graph Construction: The system transforms provenance data (audit logs) into graphs where nodes represent subjects (processes), files, and network flows, and edges represent interactions (read, write, execute, etc.). The system uses a two-hop neighborhood to capture both direct and indirect dependencies, balancing contextual information with computational efficiency.
• Self-Supervised Learning Task: Instead of predicting edge types or node labels based on attack patterns, GRASP masks the executable information of a target process node. The model (a Graph Attention Network encoder combined with a Multi-Layer Perceptron decoder) is trained to infer the masked executable based solely on the node's two-hop neighborhood context.
• Anomaly Detection Mechanism:
  • Training: The model learns the normal behavior patterns of executables within their specific neighborhood contexts.
  • Inference: During inference, if a process's observed behavior deviates significantly from the learned pattern of its associated executable (resulting in a misclassification), it is flagged as an anomaly.
  • Clustering: To handle indistinguishable behaviors (e.g., similar executables or rare events), the system clusters misclassifications observed during the final training epoch. These clusters represent benign permutations, preventing them from being flagged as anomalies during inference.
• Feature Engineering: To avoid data snooping and handle variable-length paths/IPs, the system employs a transformer-based autoencoder for location encoding and one-hot encoding for node/edge types. Unknown executables in the neighborhood are represented as zero vectors.
• Time-Windowed Reporting: The system processes data using sliding windows, generating time-based alarms rather than static node-level alerts, facilitating the tracking of anomaly evolution.

Key Contributions

1. Executable-Based Classification: A novel approach that treats process executable prediction as the primary self-supervised task, directly modeling the behavior of processes as the core of system activity.
2. Threshold-Free Detection: The system eliminates the need for threshold tuning or validation-set-dependent thresholds, relying instead on the model's learned distribution and clustering of misclassifications.
3. Robustness and Reproducibility: The authors demonstrate that GRASP provides consistent results across multiple runs, addressing the instability issues prevalent in recent related work.
4. Enhanced Anomaly Coverage: By not filtering out deviations that do not match known attack patterns, GRASP identifies potentially malicious behaviors that are undocumented in ground truth (GT) data, including changes in normal behavior.

Results and Evaluation

The authors evaluated GRASP on DARPA Transparent Computing (TC) and Operationally Transparent Cyber (OpTC) datasets, comparing it against state-of-the-art systems ORTHRUS and VELOX.

• Attack Detection: GRASP consistently detected all documented attacks in datasets where executable behavior was learnable (e.g., Cadets, OpTC), achieving an Attack Recall (Arecall) of 1.00 in most cases.
• Comparison with SOTA: While ORTHRUS and VELOX often achieved high precision by suppressing alarms (sometimes missing attacks entirely or relying on single true positives), GRASP reported significantly more alarms. However, these additional alarms corresponded to genuine deviations, including undocumented anomalous behavior.
• False Positive Analysis: The system identified that a significant portion of "false positives" in related work were actually undocumented anomalies. In the Theia E3 dataset, for instance, 39% of GRASP's alarms were attributed to novel executables.
• LOTL Attack Study: In a modified scenario where unknown executables were removed to simulate a pure LOTL attack, GRASP maintained detection capabilities, though performance varied based on the dataset's inherent learnability.
• Limitations: The system struggled with the Clearscope dataset (Android-based) due to the dominance of single executables in batches and low distinguishability of neighborhoods, resulting in low Macro-F1 scores during training.

Significance and Claims

The paper claims that GRASP represents a shift in PIDS design by moving away from threshold-dependent, edge-type prediction models toward executable-focused, self-supervised learning. The authors assert that:

• Threshold-free operation makes the system more robust against interference and adaptable to unknown activities without manual tuning.
• Executable prediction captures system behavior more effectively than edge-type prediction, as processes are the primary agents of interaction.
• Reproducibility is a critical contribution, as the system delivers stable results across multiple runs, unlike previous works that required "lucky" runs or dataset-specific hyperparameter tuning.
• Practical Utility: While the system generates more alarms than threshold-based competitors, it reduces the analyst's workload from hundreds of thousands of raw events to a manageable number of high-confidence deviations, many of which reveal undocumented system changes or potential threats.

The authors conclude that while the method is not a silver bullet (particularly for datasets with poor executable distinguishability), it offers a more comprehensive and stable approach to detecting APTs and anomalous system behavior.