EagleEye：利用注意力机制从溯源图中揭示恶意事件序列
EagleEye: Attention to Unveil Malicious Event Sequences from Provenance Graphs
AI总结：
EagleEye利用溯源图特征和事件嵌入训练轻量级Transformer模型，以检测长序列中的恶意行为，并通过注意力机制提供可解释的告警，在DARPA数据集上显著优于现有方法。
摘要：
由于威胁和攻击不断演变，端点安全防护面临巨大挑战。随着端点日志系统日趋成熟，溯源图表示使得构建复杂的行为规则成为可能。然而，依靠规则来适应新兴攻击的节奏不具备可扩展性，这推动了能够从端点日志中学习的机器学习模型的发展。尽管如此，仍然存在一些未解决的挑战：i) 恶意软件的恶意模式分布在长事件序列中；ii) 机器学习分类结果缺乏可解释性。为了解决这些问题，我们开发并提出了EagleEye，一个新颖的系统，它 i) 利用来自溯源图的丰富特征进行行为事件表示，包括命令行嵌入；ii) 提取长事件序列并学习事件嵌入；iii) 训练一个轻量级Transformer模型，将行为序列分类为恶意或非恶意。我们在两个数据集上对EagleEye进行了评估并与最先进的基线方法进行了比较，这两个数据集分别是来自企业环境的新真实世界数据集和公开的DARPA数据集。在DARPA数据集上，在1%的假阳性率下，EagleEye检测出约89%的恶意行为，以38.5%的绝对优势超越了两种最先进的解决方案。此外，我们证明了可以利用Transformer的注意力机制来突出长序列中最可疑的事件，从而为恶意软件告警提供解释。
英文摘要：
Securing endpoints is challenging due to the evolving nature of threats and attacks. With endpoint logging systems becoming mature, provenance-graph representations enable the creation of sophisticated behavior rules. However, adapting to the pace of emerging attacks is not scalable with rules. This led to the development of ML models capable of learning from endpoint logs. However, there are still open challenges: i) malicious patterns of malware are spread across long sequences of events, and ii) ML classification results are not interpretable. To address these issues, we develop and present EagleEye, a novel system that i) uses rich features from provenance graphs for behavior event representation, including command-line embeddings, ii) extracts long sequences of events and learns event embeddings, and iii) trains a lightweight Transformer model to classify behavior sequences as malicious or not. We evaluate and compare EagleEye against state-of-the-art baselines on two datasets, namely a new real-world dataset from a corporate environment, and the public DARPA dataset. On the DARPA dataset, at a false-positive rate of 1%, EagleEye detects $\approx$89% of all malicious behavior, outperforming two state-of-the-art solutions by an absolute margin of 38.5%. Furthermore, we show that the Transformer's attention mechanism can be leveraged to highlight the most suspicious events in a long sequence, thereby providing interpretation of malware alerts.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
