标题： METANOIA：一种用于缓解概念漂移的终身入侵检测和调查系统 显示英文标题

标题： METANOIA: A Lifelong Intrusion Detection and Investigation System for Mitigating Concept Drift

摘要： 随着高级持续性威胁（APT）复杂性的增加，溯源数据被越来越多地用于检测。 基于异常的系统因其与攻击知识无关的特性以及能够应对零日漏洞的能力而受到关注。 然而，传统的检测范式在离线、有限规模的数据上进行训练，常常忽略概念漂移——随着时间推移流数据分布的不可预测变化。 这导致了高误报率。 我们提出增量学习作为一种新的范式来缓解这个问题。 然而，在将增量学习作为新范式整合时，我们识别出四个挑战。 首先，长期运行的增量系统必须对抗灾难性遗忘（C1）并避免学习恶意行为（C2）。 然后，系统需要实现精确警报（C3）并重建攻击场景（C4）。 我们提出了METANOIA，第一个终身检测系统，它减轻了由于概念漂移导致的高误报率。 它通过连接伪边来对抗灾难性遗忘，将可疑状态转移以避免学习恶意行为，在路径级别过滤节点以实现精确警报，并构建小图以重建攻击场景。 使用最先进的基准测试，我们证明与之前的方法相比，METANOIA在窗口级别、图级别和节点级别的精度性能分别提高了30%、54%和29%。 显示英文摘要

摘要： As Advanced Persistent Threat (APT) complexity increases, provenance data is increasingly used for detection. Anomaly-based systems are gaining attention due to their attack-knowledge-agnostic nature and ability to counter zero-day vulnerabilities. However, traditional detection paradigms, which train on offline, limited-size data, often overlook concept drift - unpredictable changes in streaming data distribution over time. This leads to high false positive rates. We propose incremental learning as a new paradigm to mitigate this issue. However, we identify FOUR CHALLENGES while integrating incremental learning as a new paradigm. First, the long-running incremental system must combat catastrophic forgetting (C1) and avoid learning malicious behaviors (C2). Then, the system needs to achieve precise alerts (C3) and reconstruct attack scenarios (C4). We present METANOIA, the first lifelong detection system that mitigates the high false positives due to concept drift. It connects pseudo edges to combat catastrophic forgetting, transfers suspicious states to avoid learning malicious behaviors, filters nodes at the path-level to achieve precise alerts, and constructs mini-graphs to reconstruct attack scenarios. Using state-of-the-art benchmarks, we demonstrate that METANOIA improves precision performance at the window-level, graph-level, and node-level by 30%, 54%, and 29%, respectively, compared to previous approaches.