Lifelong Provenance-Based Intrusion Detection Under Concept Drift
A host intrusion-detection approach that treats anomaly detection over system provenance graphs as a continual, incremental-learning problem so the detector adapts as legitimate user behavior shifts over time. It addresses concept drift without retraining from scratch by resisting catastrophic forgetting, refusing to absorb attacker activity as normal, filtering alerts at the causal-path level, and reconstructing attack scenarios as compact mini-graphs.
2501.00438
METANOIA is a host-based intrusion-detection and investigation system for Advanced Persistent Threats built on provenance graphs (the causal graph of processes, files, and network events on a host). …