ThreatWeave-X: A Systematic Review of Graph Neural Learning for Predicting Latent Multi-Stage Cyberattack Paths from Fragmented Enterprise Security Signals
Article Sidebar
Main Article Content
Abstract
The telemetry being used by enterprise security operations is increasingly endpoint, network, identity and cloud-based, with each individually exposing only part of an adversary's actions, and multi-stage intrusions, like those stemming from advanced persistent threats, very hard to reconstruct from any single source. We present a systematic review of the methodological heritage from deterministic attack-graph generation to provenance-graph and log-based intrusion analytics, and graph neural network representation learning that spans twenty-six papers published over the past 20 years (2002-2022). It chronicles the journey from the relational and infrastructure-aware formulations of attack graph research to the inductive, attentional and relation-aware formulations of graph neural architectures, that emerged as a direct result of their scalability challenges, and the evolution of provenance-graph analytics from a purely sequence-based treatment of system behavior to a more explicit causal and relational treatment. On the basis of this synthesis, the review suggests a five-stage conceptual framework called ThreatWeave-X, which integrates multi-source signals from various sources into a single heterogeneous provenance graph, relational and attentional graph-neural embedding and a sequence-aware attention mechanism with an analyst feedback loop to rank candidate multi-stage attack paths. The review also outlines four cross-cutting challenges that appear in the reviewed literature that are still not completely addressed: 1) incompleteness of multi-modal heterogeneity handling, 2) scarcity of labels, 3) limited interpretability, and 4) inconsistent evaluation protocols, which all suggest directions for future empirical validation of the graph-neural multi-stage attack-path prediction.
Article Details
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
References
[1] A. Alshamrani, S. Myneni, A. Chowdhary, and D. Huang, “A survey on advanced persistent threats: Techniques, solutions, challenges, and research opportunities,” IEEE Commun. Surv. Tutorials, vol. 21, no. 2, pp. 1851–1877, 2019, doi: https://doi.org/10.1109/COMST.2019.2891891.
[2] P. Ammann, D. Wijesekera, and S. Kaushik, “Scalable, graph-based network vulnerability analysis,” in Proceedings of the 9th ACM Conference on Computer and Communications Security, 2002, pp. 217–224. doi: https://doi.org/10.1145/586110.586140.
[3] A. L. Buczak and E. Guven, “A survey of data mining and machine learning methods for cyber security intrusion detection,” IEEE Commun. Surv. tutorials, vol. 18, no. 2, pp. 1153–1176, 2015, doi: https://doi.org/10.1109/COMST.2015.2494502.
[4] M. Du, F. Li, G. Zheng, and V. Srikumar, “Deeplog: Anomaly detection and diagnosis from system logs through deep learning,” in Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, 2017, pp. 1285–1298. doi: https://doi.org/10.1145/3133956.3134015.
[5] A. Grover and J. Leskovec, “node2vec: Scalable feature learning for networks,” in Proceedings of the 22nd ACM SIGKDD international conference on Knowledge discovery and data mining, 2016, pp. 855–864. doi: https://doi.org/10.1145/2939672.2939754.
[6] O. Sheyner, J. Haines, S. Jha, R. Lippmann, and J. M. Wing, “Automated generation and analysis of attack graphs,” in Proceedings 2002 IEEE Symposium on Security and Privacy, 2002, pp. 273–284. doi: 10.1109/SECPRI.2002.1004377.
[7] X. Ou, W. F. Boyer, and M. A. McQueen, “A scalable approach to attack graph generation,” in Proceedings of the 13th ACM Conference on Computer and Communications Security, in CCS ’06. New York, NY, USA: Association for Computing Machinery, 2006, pp. 336–345. doi: 10.1145/1180405.1180446.
[8] O. Stan et al., “Extending Attack Graphs to Represent Cyber-Attacks in Communication Protocols and Modern IT Networks,” IEEE Trans. Dependable Secur. Comput., vol. 19, no. 03, pp. 1936–1954, 2022, doi: 10.1109/TDSC.2020.3041999.
[9] W. Hamilton, Z. Ying, and J. Leskovec, “Inductive Representation Learning on Large Graphs,” in Advances in Neural Information Processing Systems, I. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, Eds., Curran Associates, Inc., 2017. doi: https://doi.org/10.48550/arXiv.1706.02216.
[10] Y. Liu et al., “Towards a timely causality analysis for enterprise security.,” in NDSS, 2018, p. 141. doi: http://dx.doi.org/10.14722/ndss.2018.23254.
[11] E. Manzoor, S. M. Milajerdi, and L. Akoglu, “Fast memory-efficient anomaly detection in streaming heterogeneous graphs,” in Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, 2016, pp. 1035–1044. doi: https://doi.org/10.1145/2939672.2939783.
[12] S. M. Milajerdi, R. Gjomemo, B. Eshete, R. Sekar, and V. N. Venkatakrishnan, “HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows,” in 2019 IEEE Symposium on Security and Privacy (SP), 2019, pp. 1137–1152. doi: 10.1109/SP.2019.00026.
[13] S. M. Milajerdi, B. Eshete, R. Gjomemo, and V. N. Venkatakrishnan, “Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting,” in Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, 2019, pp. 1795–1812. doi: https://doi.org/10.1145/3319535.3363217.
[14] F. Liu, Y. Wen, D. Zhang, X. Jiang, X. Xing, and D. Meng, “Log2vec: A heterogeneous graph embedding based approach for detecting cyber threats within enterprise,” in Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, 2019, pp. 1777–1794. doi: https://doi.org/10.1145/3319535.3363224.
[15] S. Wang et al., “THREATRACE: Detecting and Tracing Host-Based Threats in Node Level Through Provenance Graph Learning,” IEEE Trans. Inf. Forensics Secur., vol. 17, pp. 3972–3987, 2022, doi: 10.1109/TIFS.2022.3208815.
[16] A. Khraisat, I. Gondal, P. Vamplew, and J. Kamruzzaman, “Survey of intrusion detection systems: techniques, datasets and challenges,” Cybersecurity, vol. 2, no. 1, p. 20, 2019, doi: https://doi.org/10.1186/s42400-019-0038-7.
[17] F. Scarselli, M. Gori, A. C. Tsoi, M. Hagenbuchner, and G. Monfardini, “The Graph Neural Network Model,” IEEE Trans. Neural Networks, vol. 20, no. 1, pp. 61–80, 2009, doi: 10.1109/TNN.2008.2005605.
[18] T. N. Kipf and M. Welling, “Semi-supervised classification with graph convolutional networks,” arXiv Prepr. arXiv1609.02907, 2017, doi: https://doi.org/10.48550/arXiv.1609.02907.
[19] P. Veličković, G. Cucurull, A. Casanova, A. Romero, P. Lio, and Y. Bengio, “Graph attention networks,” arXiv:1710.10903, 2017. doi: https://doi.org/10.48550/arXiv.1710.10903.
[20] M. Schlichtkrull, T. N. Kipf, P. Bloem, R. van den Berg, I. Titov, and M. Welling, “Modeling Relational Data with Graph Convolutional Networks,” in 15th International Conference Semantic Web (ESWC 2018), A. Gangemi, R. Navigli, M.-E. Vidal, P. Hitzler, R. Troncy, L. Hollink, A. Tordai, and M. Alam, Eds., Cham: Springer International Publishing, 2018, pp. 593–607. doi: https://doi.org/10.1007/978-3-319-93417-4_38.
[21] X. Wang et al., “Heterogeneous Graph Attention Network,” in The World Wide Web Conference, New York, NY, USA: Association for Computing Machinery, 2019, pp. 2022–2032. doi: 10.1145/3308558.3313562.
[22] N. Moustafa and J. Slay, “UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),” in 2015 military communications and information systems conference (MilCIS), Ieee, 2015, pp. 1–6. doi: https://doi.org/10.1109/MilCIS.2015.7348942.
[23] M. Ring, S. Wunderlich, D. Scheuring, D. Landes, and A. Hotho, “A survey of network-based intrusion detection data sets,” Comput. Secur., vol. 86, pp. 147–167, 2019, doi: https://doi.org/10.1016/j.cose.2019.06.005.
[24] G. Pang, C. Shen, L. Cao, and A. Van Den Hengel, “Deep Learning for Anomaly Detection: A Review,” ACM Comput. Surv., vol. 54, no. 2, pp. 1–38, 2021, doi: 10.1145/3439950.