Fine-Grained Threat Detection from Audit Logs via Dynamic Provenance Graph Learning

Abstract

Advanced Persistent Threats (APTs) often involve long-term and multi-stage behaviors, making them difficult to detect from massive audit logs. Provenance graphs can capture causal relationships among system activities, but existing methods still face challenges in modeling entity-level temporal evolution and controlling computational overhead. To address these issues, we propose DynaGuard, a dynamic provenance graph learning framework for efficient and fine-grained threat detection. DynaGuard constructs provenance graph snapshots from audit logs, aggregates multi-hop neighborhood information with GraphSAGE, and recurrently updates node representations using historical states. It also adopts truncated back-propagation through time to bound the size of the active computation graph. Experimental results show that DynaGuard achieves the highest F-scores in all seven evaluated scenarios. Compared with Flash, DynaGuard reduces false positives from 3,477 to 1,369 on the Trace subset and achieves inference speedups ranging from 2.62× to 4.31× on the DARPA E3 subsets.