Intrusion alerts stop arriving as one lump: grouping processes by behavior lifts THEIA-E5 recall from 0.17 to 0.61
Synopsis
Provenance-based intrusion detection systems face a precision-recall bind: suppressing false alerts misses attack entities, while raising recall buries analysts. Targeter stops modeling all processes with one detector, sorting processes into behavioral categories by command-line semantics and training a lightweight graph autoencoder per category, with deterministic routing at inference. Across six DARPA Transparent Computing benchmarks it reports a better F2 balance than existing node-level systems on most datasets; on THEIA-E5 recall is 0.61 versus 0.17 for ORTHRUS, though on CADETS-E3 its F2 trails ORTHRUS.
Interpretation
Alert quality in provenance-based intrusion detection splits into two things: whether alerts point at attack entities accurately, and whether they cover enough of the attack. Prior node-level systems traded one for the other, with ORTHRUS buying precision through very few false positives while missing many attack nodes, and MAGIC reaching near-perfect recall on most datasets at the cost of overwhelming false alerts. Prior node-level detectors handed all process behavior to a single model, mixing heterogeneous normal behavior so that benign variation and anomalous activity were hard to separate. On six datasets from DARPA Transparent Computing Engagements 3 and 5, precision, recall and a recall-weighted F2 score are counted under exact node-level matching, and Targeter reports a more balanced result on most datasets.
Each behavioral category trains its own detector on its own subgraphs, so the normal-behavior distribution it learns is more homogeneous. Processes are assigned to predefined categories by deterministic rules over command-line semantics, with unmatched processes falling into a generic category; categories only route processes and are not detection labels, so detection stays unsupervised and anomaly-driven. The detector is a graph autoencoder: three graph convolutional layers aggregate neighbor information and compress node features to a low dimension, a fully connected decoder reconstructs the input, and nodes whose reconstruction error exceeds the category's validation maximum are flagged suspicious. On THEIA-E3, correctly detected attack nodes rise from 0 in the single-model configuration and 1 under random grouping to 63; on CADETS-E5, false positives fall from 2360 single-model and 4263 random-grouping to 875.
Perspective
Evaluation is confined to the DARPA Transparent Computing Engagement 3 and Engagement 5 benchmarks in a single-host setting, and assumes audit logs and the derived provenance graph are not tampered with or forged by an adversary; coordinated or distributed attacks across hosts are out of scope.
Behavioral categories are currently defined by hand, and discovering them automatically remains open; specialization applies only to process entities, with files and network entities modeled through their interactions with processes; categories with few benign samples leave their models unable to learn normal behavior well, as seen on CADETS-E3.