Intrusion Detection Systems (IDS) are essential tools for detecting and analyzing malicious system activity. Anomaly-based IDS have gained popularity due to their ability to detect zero-day attacks, unlike signature-based IDS. Although this approach is promising, recent AI-based IDS still suffer from high false positive rates, non-scalability and biases, which limit their practicality in real-world deployments.This paper presents GRAAL, an end-to-end unsupervised graph-based anomaly-based IDS that allows a scalable multi-level detection, achieves a low false positive rate, and provides intuitive and interpretable outputs to assist analysts in threat detection and investigation. GRAAL proposes a method to extract features from heterogeneous provenance graphs, using a combination of structural and attribute embeddings. These vectors are then processed by multiple autoencoder models to detect anomalies at both graph and system entity levels. GRAAL’s models leverage the relationship between the graph and entity levels, sharing knowledge through transfer learning and combining their results. We compare GRAAL against six state-of-the-art IDS on several datasets. These comparisons reveal methodological and reproducible biases in the evaluation of the current IDS and lead us to define best practices. To perform a comprehensive comparison, we mitigate biases still present in these state-of-the-art IDS. These extensive evaluations of GRAAL show that GRAAL outperforms these IDS, with a higher precision.
Fanny Dijoud, Pierre-François Gimenez, Michel Hurfin et al.· European Symposium on Securi...· 0 citations
: Mapping unstructured Cyber Threat Intelligence (CTI) reports to the MITRE ATT&CK framework is critical for proactive defence but remains a manual, time-consuming process. Existing automated approaches either rely on black-box language models that lack interpretable reasoning or brittle, rule-based knowledge graphs that fail to scale. To bridge this gap, we propose Graph2TTP, a novel neural-symbolic framework for automated, paragraph-level Tactic, Technique and Procedure (TTP) identification. Graph2TTP leverages the zero-shot comprehension of Large Language Models (LLMs) to automatically extract entities and relations from extensive CTI narratives, constructing rich, localized Cyber Security Knowledge Graphs (CSKGs). We encode these symbolic structures into dense embeddings and process them via a multi-label Edge-featured Graph Attention Network (EGAT). This hybrid architecture delivers both the high-fidelity accuracy of neural networks and the transparent, verifiable reasoning paths required by security analysts. To facilitate rigorous evaluation, we curate and release APTCTI, a real-world dataset comprising 690 Advanced Persistent Threat reports spanning over 18,087 paragraphs. Extensive evaluations across multiple datasets demonstrate that Graph2TTP outperforms state-of-the-art neural baselines (e.g., CySecBERT) by approximately 20% in F1 score, establishing a robust new standard for accurate and interpretable threat intelligence analysis.
Patrick Zounon, Yufei Han, Michel Hurfin et al.· Proceedings of the 23rd Inte...· 0 citations