Incorporating Gradients to Rules: Toward Online, Adaptive Provenance-Based Intrusion Detection
Abstract
As cyber-attacks become increasingly sophisticated and stealthy, accurately distinguishing between benign behavior and malicious intrusions has become both more critical and more challenging. Provenance-based intrusion detection systems (PIDS) show strong potential for detecting malicious activities through fine-grained causality analysis, which has gained significant attention from both industry and academia. Among the various PIDS approaches, rule-based systems are particularly favored for their low overhead, real-time detection capability, and interpretability. However, these systems face challenges in reducing false positive rates, primarily due to the lack of fine-tuned rules and specific environments. In this paper, we introduce CAPTAIN+, a rule-based PIDS that autonomously adapts to diverse environments online. Specifically, we propose three adaptive parameters to adjust the detection configuration for nodes, edges, and alarm generation thresholds. Initially, we build a differentiable tag propagation framework and utilize the gradient descent algorithm to optimize these adaptive parameters based on the training data. In this extended version, we integrate an online learning module into the detection stage to dynamically optimize adaptive parameters based on real-time feedback from the detection process. We evaluate CAPTAIN+ based on data from DARPA TC, OpTC datasets, and PKU ASAL datasets. The results demonstrate that CAPTAIN+ offers superior detection accuracy, lower…
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
CAPTAIN transformed traditional rules into a differentiable framework, utilizing gradient descent to adaptively optimize parameters on benign data, but it still carries the risk of false negatives for unknown attacks that do not deviate significantly from normal patterns.
“CAPTAIN innovatively transformed traditional rules into a differentiable framework, utilizing gradient descent to adaptively optimize parameters on benign data, though it still carries the risk of false negatives for unknown attacks that do not deviate significantly from normal patterns[7].”
From From Correlation to Intervention: A Survey on Log-Based Causal Analysis for Security and AIOps (2026) · cites this paper as [7]
Cites
Chandola, V., Banerjee, A., & Kumar, V. (2009) · ACM Computing Surveys · doi:10.1145/1541880.1541882 · Cited by 11,687 · see citing works
A Stochastic Approximation Method
Robbins, H., & Monro, S. (1951) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177729586 · Cited by 9,643 · see citing works
Support vector domain description
Tax, D. M. J., & Duin, R. P. W. (1999) · Pattern Recognition Letters · doi:10.1016/s0167-8655(99)00087-2 · Cited by 1,632 · see citing works
Arzt, S., Rasthofer, S., Fritz, C., Bodden, E., Bartel, A., Klein, J., Traon, Y. L., Octeau, D., & McDaniel, P. D. (2014) · ACM SIGPLAN Notices · doi:10.1145/2666356.2594299 · Cited by 947 · see citing works
Alshamrani, A., Myneni, S., Chowdhary, A., & Huang, D. (2019) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2019.2891891 · Cited by 665 · see citing works
One-class classification: taxonomy of study and review of techniques
Khan, S. S., & Madden, M. G. (2014) · The Knowledge Engineering Review · doi:10.1017/s026988891300043x · Cited by 605 · see citing works
Engineering Design Optimization
Martins, J. R. R. A., & Ning, A. (2021) · Cambridge University Press eBooks · doi:10.1017/9781108980647 · Cited by 575 · see citing works
HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows
Milajerdi, S. M., Gjomemo, R., Eshete, B., Sekar, R., & Venkatakrishnan, V. N. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00026 · Cited by 573 · see citing works
NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage
Hassan, W. U., Guo, S., Li, D., Chen, Z., Jee, K., Li, Z., & Bates, A. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23349 · Cited by 375 · see citing works
Self-citationUNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats
Han, X., Pasquier, T., Bates, A., Mickens, J., & Seltzer, M. (2020) · Proceedings 2020 Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.24046 · Cited by 349 · see citing works
Milajerdi, S. M., Eshete, B., Gjomemo, R., & Venkatakrishnan, V. N. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363217 · Cited by 314 · see citing works
You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis
Wang, Q., Hassan, W. U., Li, D., Jee, K., Yu, X., Zou, K., Rhee, J., Chen, Z., Cheng, W. X., Gunter, C. A., et al. (2020) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.24167 · Cited by 256 · see citing works
THREATRACE: Detecting and Tracing Host-Based Threats in Node Level Through Provenance Graph Learning
Wang, S., Wang, Z., Zhou, T., Sun, H., Yin, X., Han, D., Zhang, H., Shi, X., & Yang, J. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3208815 · Cited by 248 · see citing works
Self-citationProTracer: Towards Practical Provenance Tracing by Alternating Between Logging and Tainting
Ma, S., Zhang, X., & Xu, D. (2016) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23350 · Cited by 202 · see citing works
SHADEWATCHER: Recommendation-guided Cyber Threat Analysis using System Audit Records
Zengy, J., Wang, X., Liu, J., Chen, Y., Liang, Z., Chua, T., & Chua, Z. L. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833669 · Cited by 194 · see citing works
Self-citationCombating Dependence Explosion in Forensic Analysis Using Alternative Tag Propagation Semantics
Hossain, M. N., Sheikhi, S., & Sekar, R. (2020) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40000.2020.00064 · Cited by 166 · see citing works
Provenance-based Intrusion Detection Systems: A Survey
Zipperle, M., Gottwalt, F., Chang, E. J., & Dillon, T. S. (2022) · ACM Computing Surveys · doi:10.1145/3539605 · Cited by 160 · see citing works
Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance
Cheng, Z., Lv, Q., Liang, J., Wang, Y., Sun, D., Pasquier, T., & Han, X. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00005 · Cited by 157 · see citing works
Conan: A Practical Real-Time APT Detection System With High Accuracy and Efficiency
Xiong, C., Zhu, T., Dong, W.-H., Ruan, L., Yang, R., Cheng, Y., Chen, Y., Cheng, S., & Chen, X. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.2971484 · Cited by 146 · see citing works
Self-citationFlash: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning
Rehman, M. U., Ahmadi, H., & Hassan, W. U. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00139 · Cited by 127 · see citing works
Threat detection and investigation with system-level provenance graphs: A survey
Li, Z., Chen, Q. A., Yang, R., Chen, Y., & Ruan, W. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102282 · Cited by 117 · see citing works
Self-citationA provenance-based access control model
Park, J., Nguyen, D., & Sandhu, R. S. (2012) · International Conference on Privacy, Security and Trust (PST) · doi:10.1109/pst.2012.6297930 · Cited by 93 · see citing works
Log-Based Anomaly Detection With Robust Feature Extraction and Online Learning
Han, S., Wu, Q., Zhang, H., Qin, B., Hu, J., Shi, X., Liu, L., & Yin, X. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3053371 · Cited by 88 · see citing works
Investigating System Operators' Perspective on Security Misconfigurations
Dietrich, C., Krombholz, K., Borgolte, K., & Fiebig, T. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243794 · Cited by 87 · see citing works
Goyal, A., Han, X., Wang, G., & Bates, A. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.24207 · Cited by 67 · see citing works
NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation
Li, S., Dong, F., Xiao, X., Wang, H., Shao, F., Chen, J., Guo, Y., Chen, X., & Li, D. (2024) · Proceedings 2024 Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.23204 · Cited by 45 · see citing works
R-CAID: Embedding Root Cause Analysis within Provenance-based Intrusion Detection
Goyal, A., Wang, G., & Bates, A. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00253 · Cited by 41 · see citing works
Are we there yet? An Industrial Viewpoint on Provenance-based Endpoint Detection and Response Tools
Dong, F., Li, S., Jiang, P., Li, D., Wang, H., Huang, L., Xiao, X., Chen, J., Luo, X., Guo, Y., et al. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3616580 · Cited by 38 · see citing works
AOC-IDS: Autonomous Online Framework with Contrastive Learning for Intrusion Detection
Zhang, X., Zhao, R., Jiang, Z., Sun, Z., Ding, Y., Ngai, E. C. ‐., & Yang, S. (2024) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom52122.2024.10621346 · Cited by 38 · see citing works
Incorporating Gradients to Rules: Towards Lightweight, Adaptive Provenance-based Intrusion Detection
Wang, L., Shen, X., Li, W., Li, Z., Sekar, R., Liu, H., & Chen, Y. (2025) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2025.230822 · Cited by 31 · see citing works
Self-citationUsing a Fuzzy Inference System to Reduce False Positives in Intrusion Detection
Spathoulas, G. P., & Katsikas, S. K. (2009) · International Conference on Systems, Signals and Image Processing · doi:10.1109/iwssip.2009.5367701 · Cited by 19 · see citing works
Wei, Y., Cheng, C., & Xie, G. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3230501 · Cited by 17 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
From Correlation to Intervention: A Survey on Log-Based Causal Analysis for Security and AIOps
Zhu, Y., Li, X., Suo, J., Yin, Y., & Huang, C. (2026) · 2026 International Conference on AI in Education Technology and Applications (AIETA) · doi:10.1109/aieta69357.2026.11508946
LogMamba: Efficient Graph-Level Anomaly Detection for APTs via State Space Models
Li, W., Chen, Y., Zhu, K., Yan, W., Wang, X., Tian, T., Jiang, B., & Lu, Z. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11582008
Self-citation
- Authors
- Li, Z., Wang, L., Wang, Z., Shen, X., Xu, H., Chen, Y., & Ji, S.
- Affiliations
- Zhejiang University (CN)
- Northwestern University (US)
- Venue
- IEEE Transactions on Dependable and Secure Computing
- Published
- 2026-01
- Volume
- 23
- Issue
- 1
- Pages
- 782-798
- ISSN
- 1545-5971 (ISSN-L)
- 1941-0018
- 2160-9209
- OpenAlex
- W4414321939
- Cited by
- 2
- References
- 32
- Citations by year
- 2026: 2
- FWCI
- 0.84
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Transactions on Dependable and Secure Computing (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- rule-based intrusion detection, online learning, adaptive parameters, false positive reduction, concept drift, captains, network security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
