arXiv 2603.093582026-03-10cs.CR

ProvAgent：基于身份-行为绑定和多智能体协作攻击调查的威胁检测

ProvAgent: Threat Detection Based on Identity-Behavior Binding and Multi-Agent Collaborative Attack Investigation

Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Zhongguancun Laboratory（中关村实验室）

Wenhao Yan, Ning An, Linxu Li, Bingsheng Bi, Bo Jiang, Zhigang Lu, Baoxu Liu, Junrong Liu, Cong Dong

备注：: The code of ProvAgent is publicly available at \url{https://github.com/Win7ery/ProvAgent}

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

ProvAgent通过多智能体协作与传统模型结合，实现高效威胁检测与自动化攻击调查，提升安全响应效率与准确性。

摘要：

高级持续性威胁（APTs）由于其多阶段和隐蔽性，对现代网络安全构成了严峻挑战。尽管基于溯源的检测方法在捕捉因果攻击语义方面显示出潜力，但当前的威胁溯源实践面临两个悖论性问题：（1）专家怀疑，即人类分析师怀疑传统检测模型识别复杂攻击的能力；（2）专家依赖，分析师无法在没有这些模型的情况下手动处理大规模原始日志以检测威胁。因此，人与传统模型之间的合作仍然是主流范式。然而，这种合作使调查质量依赖于人类专业知识，经常导致警报疲劳。为了解决这些挑战，我们提出了ProvAgent，一个框架，将威胁溯源范式从人-模型协作转变为多智能体系统与传统模型之间的新型协作。ProvAgent利用传统模型在大规模日志上的速度和成本效益进行初步异常筛查。通过强制细粒度的身份-行为一致性，利用图对比学习，它根据特定属性对实体进行建模，以生成高保真的警报。这些警报作为调查切入点，通过假设验证的多智能体框架实现深入的自主调查。使用真实世界数据集的评估表明，ProvAgent在异常检测方面优于六个最先进的（SOTA）基线。通过自动化调查，ProvAgent在最低成本（每天0.06美元）下重建几乎完整的攻击过程。

英文摘要：

Advanced Persistent Threats (APTs) pose critical challenges to modern cybersecurity due to their multi-stage and stealthy nature. While provenance-based detection approaches show promise in capturing causal attack semantics, current threat provenance practices face two paradoxical issues: (1) expert skepticism, where human analysts doubt the capability of traditional detection models to identify complex attacks; and (2) expert dependence, as analysts cannot manually process large-scale raw logs to detect threats without these models. Consequently, collaboration between humans and traditional models remains the prevailing paradigm. However, this renders investigation quality contingent upon human expertise and frequently results in alert fatigue. To address these challenges, we present ProvAgent, a framework that evolves the threat provenance paradigm from human-model collaboration to a novel collaboration between multi-agent systems and traditional models. ProvAgent leverages the speed and cost-efficiency of traditional models for initial anomaly screening over large-scale logs. By enforcing fine-grained identity-behavior consistency via graph contrastive learning, it profiles entities based on specific attributes to generate high-fidelity alerts. With these alerts serving as investigation entry points, ProvAgent achieves in-depth autonomous investigation through a hypothesis-verification multi-agent framework. Evaluations with real-world datasets demonstrate that ProvAgent outperforms six state-of-the-art (SOTA) baselines in anomaly detection. Through automated investigation, ProvAgent reconstructs near-complete attack processes at a minimum cost of \$0.06 per day.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

AI总结：

摘要：

英文摘要：

相关论文