Third-party cyber evaluations involving OpenAI models
openai.com·13h ago
AI Research
arXiv CS.AI·Jun 10·10 min read
A Source Domain is All You Need: Source-Only Cross-OS Transfer Learning for APT Anomaly Detection via Semantic Alignment and Optimal Transport
TL;DR
Advanced Persistent Threats (APTs) are challenging to detect, especially when transferring detection models across different operating systems without target data. A novel framework was developed that uses Optimal Transport (OT) to score anomalies based on source-domain data alone.
✦ Why It Matters
Engineers can implement this framework to enhance APT detection capabilities across diverse operating systems without needing target data.
Key Takeaways
- Utilize source-only models for cross-OS APT detection.
- Leverage system-level provenance traces for anomaly scoring.
- Implement Optimal Transport for quantifying deviations.
- Focus on semantic and structural analysis of process behavior.
Full Summary
APTs are sophisticated cyberattacks that are hard to identify due to limited labeled data and the complexities of cross-operating-system (cross-OS) environments. This research introduces a source-only transfer learning framework for APT detection that leverages system-level provenance traces, which are records of system activity.
The framework employs Optimal Transport (OT) to create a barycentric anomaly score, which quantifies how much target process behavior deviates from a reference model built from source-domain data. It integrates three evidence channels: semantic deviation using natural language processing, structural deviation through graph autoencoding, and geometric deviation via OT.
Testing on DARPA Transparent Computing data across various operating systems demonstrated improved performance metrics, including ROC-AUC and nDCG, over traditional anomaly detection methods. These findings suggest that using source-only models can effectively detect APTs across different platforms without requiring labeled data from the target domain.