ThreaTrace'22 IEEE TIFS

Prerequisites

To deconstruct this paper effectively, we will need three foundations:

• Provenance Graphs that you can check here
• GraphSAGE that you can check here

To have an idea about what datasets being used:

• DARPA TC E3 and CDM v.18 Schema that you can check here

The "Granularity" Shift

The authors highlight the mismatch between the stealthy nature of modern APTs and the blunt instrument nature of existing whole-graph detection methods like Unicorn and StreamSpot.

The Problem

APTs are defined by their "low-and-slow" strategy. They deliberately hide within massive amounts of benign system activity to avoid detection.

• The Statistic: In a typical compromised system, the actual malicious activity is microscopic.

  "In this example, there are millions of benign nodes and less than 30,000 anomalous nodes. The proportion of anomalous nodes is less than 1%." — ThreatRace (Wang et al., 2022)

• The Consequence: An effective detector must be sensitive enough to identify a $1\%$ anomaly rate without generating false alarms from the $99\%$ benign background noise.

The Limitation

The "Whole-Graph" Trap

Existing state-of-the-art tools (like Unicorn and StreamSpot) rely Graph Kernel Algorithms.

• Mechanism: They process the entire system's provenance graph to extract a single global feature set (embedding) or sketch.
• The Flaw: By avereging or summarizing the whole graph:
  • The "signal" (the $\lt 1\%$ of malicious nodes) gets diluted by the "noise" (the $99\%$ of benign nodes).
  • The system can say "Something is worng!" but it can't say "Where?" or "Why?".
• The Verdict: These methods are not sensitive to the small number of threat-related entities, leading to missed detections in stealthy campaigns.

The Solution

ThreaTrace abandons the "whole-graph" view for a "node-level" inspection.

Feature	Whole-Graph Approach (Unicorn)	Node-Level Approach (ThreaTrace)
Unit of Analysis	The entire Provenance Graph	Individual System Entities (Process, File, Socket)
Detection Logic	"Is the overall system structure weird?"	"Is this specific process behaving weirdly?"
Granularity	Coarse (System-wide alert)	Fine (Entity-specific alert)
Outcome	Can miss stealthy $\lt 1\%$ attacks	Can pinpoint the exact "Patient Zero"

The core philosophy:

"We present THREATRACE... to detect host-based threats at system entity level... formalizing the problem as an anomalous nodes detection problem."

The "Unsupervised" Challenge

1. The Core Dilemma: "Zero-Day" Blindness

Traditional security systems rely on signatures or labeled attack data.

• The Challenge: We assume the attacker uses "zero-day exploits" (never-before-seen vulnerabilities).
• The Constraint: We cannot train the model on "attack data" because we don't know what future attacks will look like.
• The Only Option: We must train "only on benign data". The model must learn what normal looks like so perfectly that anything else stands out as an anomaly.

2. The Engine: GraphSAGE (Inductive Learning)

ThreaTrace employs GraphSAGE, a graph neural network designed for inductive learning.

• What is Inductive Learning?

  • Transductive (Old way): Memorizing the specific graph you trained on. If a new node appears, the model breaks.
  • Inductive (GraphSAGE): Learning a rule or function. If a new node appears, the model apply the rule to understand it.

• Why GraphSAGE?

  • It learns to generate embeddings (digital summaries) for nodes by aggregating information from their neighbors.

• The Training Game (Link Prediction)

  • The model plays a game: "Given this node, can you predict its neighbors?"
  • Since it trains only on normal data, it becomes an expert at predicting normal neighbors.
  • Detection: When an attack happens (e.g., Process connects to a Sensitive File), the model fails to predict it. $\text{High Prediction Error} \implies \text{Anomaly}$

3. The Innovation: Multi-Model Framework

A single model is not enough because of the Data Imbalance Problem.

• The Problem: In a computer system, some events happen millions of times (e.g., file reads), while others happen rarely (e.g., socket connections).

  • Analogy: If you train a system to recognize "animals" using $1,000,000$ photos of dogs and $5$ photos of cats, it will think everything is a dog. It will ignore the cats.

• The ThreaTrace Solution:

  • Instead of one giant model, they use a Committee of Experts (Multiple Sub-Models).
  • They split the training data into smaller chunks.
  • Iterative Training:
    1. Train model A.
    2. Ask model A "what you do understand perfectly?"
    3. Remove those "understood" nodes.
    4. Train model B on the remaining nodes.
    5. Repeat.

• The Result: Even rare, unique system behaviors get their own dedicated sub-model, ensuring they aren't flagged as false positives just because they are rare.

ThreatRace transforms APT detection from "looking for bad patterns" (which fails on zero-days) to "deeply understanding normal roles" using a specialized, multi-layered neural network that doesn't ignore the "rare but normal" events.

The System Pipeline

The Trace Capability

The Proof