Mehdi Kharrazi

Provenance-based intrusion detection systems face a precision-recall bind: suppressing false alerts misses attack entities, while raising recall buries analysts. Targeter stops modeling all processes with one detector, sorting processes into behavioral categories by command-line semantics and training a lightweight graph autoencoder per category, with deterministic routing at inference. Across six DARPA Transparent Computing benchmarks it reports a better F2 balance than existing node-level systems on most datasets; on THEIA-E5 recall is 0.61 versus 0.17 for ORTHRUS, though on CADETS-E3 its F2 trails ORTHRUS.

Provenance-based intrusion detection systems face a precision-recall bind: suppressing false alerts misses attack entities, while raising recall buries analysts. Targeter stops modeling all processes with one detector, sorting processes into behavioral categories by command-line semantics and training a lightweight graph autoencoder per category, with deterministic routing at inference. Across six DARPA Transparent Computing benchmarks it reports a better F2 balance than existing node-level systems on most datasets; on THEIA-E5 recall is 0.61 versus 0.17 for ORTHRUS, though on CADETS-E3 its F2 trails ORTHRUS.