Tidal: Tackling Concept Drift in Provenance-Based Advanced Persistent Threats Detection

Advanced Persistent Threats (APTs) pose significant challenges to cybersecurity due to their evolving nature and ability to evade detection. This paper introduces Tidal, a novel provenance-based intrusion detection system (PIDS) that is specifically designed to address concept drift in APT detection. Tidal designs a modified Transformer architecture tailored for transfer learning, including a Multi-head Transformer (MHT) with shared layers for learning common knowledge and task-specific head layers for learning unique patterns. The system uses a pre-training and fine-tuning workflow to achieve high post-drift adaptation and pre-drift retention accuracy. Additionally, Tidal customizes its data embedding for…

• CS
  Cisco Systems
• OO
  Office of Naval Research
• LD
  Laboratory Directed Research and Development
• SN
  Sandia National Laboratories