RPG-AE：基于罕见模式挖掘的图自编码器用于基于溯源的异常检测
RPG-AE: Neuro-Symbolic Graph Autoencoders with Rare Pattern Mining for Provenance-Based Anomaly Detection
AI总结：
RPG-AE通过结合图自编码器与罕见模式挖掘，提升基于溯源的异常检测效果和可解释性。
摘要：
高级持续性威胁（APTs）是复杂的、长期的网络攻击，由于其操作隐蔽且常融入正常系统行为，难以检测。本文提出了一种结合图自编码器（GAE）与罕见模式挖掘的神经符号异常检测框架，用于识别系统级溯源数据中的APT-like活动。我们的方法首先基于特征相似性使用k-近邻构建过程行为图，然后利用图自编码器学习正常关系结构。通过观测与重构图结构之间的偏差来识别异常候选。为进一步提高检测效果，我们整合了一个罕见模式挖掘模块，发现罕见的行为共现，并利用这些来提升具有罕见特征的过程的异常得分。我们在DARPA透明计算数据集上评估了所提出的方法，证明了罕见模式增强在异常排序质量上显著优于基线GAE。与现有无监督方法相比，我们的单一统一模型在相同基准上始终优于单独的上下文检测器，并在性能上与需要多个单独检测器的集合聚合方法相媲美。这些结果突显了将基于图的表示学习与经典模式挖掘结合的价值，以提高溯源安全异常检测的有效性和可解释性。
英文摘要：
Advanced Persistent Threats (APTs) are sophisticated, long-term cyberattacks that are difficult to detect because they operate stealthily and often blend into normal system behavior. This paper presents a neuro-symbolic anomaly detection framework that combines a Graph Autoencoder (GAE) with rare pattern mining to identify APT-like activities in system-level provenance data. Our approach first constructs a process behavioral graph using k-Nearest Neighbors based on feature similarity, then learns normal relational structure using a Graph Autoencoder. Anomaly candidates are identified through deviations between observed and reconstructed graph structure. To further improve detection, we integrate an rare pattern mining module that discovers infrequent behavioral co-occurrences and uses them to boost anomaly scores for processes exhibiting rare signatures. We evaluate the proposed method on the DARPA Transparent Computing datasets and show that rare-pattern boosting yields substantial gains in anomaly ranking quality over the baseline GAE. Compared with existing unsupervised approaches on the same benchmark, our single unified model consistently outperforms individual context-based detectors and achieves performance competitive with ensemble aggregation methods that require multiple separate detectors. These results highlight the value of coupling graph-based representation learning with classical pattern mining to improve both effectiveness and interpretability in provenance-based security anomaly detection.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
