Provenance-based threat detection tools and stealthy malware detection

A non-transitory computer readable storage medium comprising a computer readable program for a computer implemented provenance-based threat detection tool, wherein the computer readable program when executed on a computer causes the computer to perform the steps of:

• building a provenance graph including a plurality of paths using a processor device from provenance data obtained from one or more computer systems and/or networks;
• sampling the provenance graph to form a plurality of linear sample paths;
• calculating a regularity score for each of the plurality of linear sample paths using a processor device;
• selecting a subset of linear sample paths from the plurality of linear sample paths based on the regularity score;
• embedding each of the subset of linear sample paths by converting each of the subset of linear sample paths into a numerical vector using a processor device;
• detecting anomalies in the embedded paths to identify malicious process activities;
• and
• terminating a process related to the embedded path having the identified malicious process activities.

A system for provenance-based threat detection, comprising:

• a computer system including:
• random access memory configured to store a provenance-based threat detection tool;
• one or more processor devices and an operating system having a kernel, wherein one or more hook functions operating in the kernel are configured to collect provenance data;
• and
• a database configured to store the provenance data collected by the one or more hook functions, wherein the provenance-based threat detection tool is configured to:
• build a provenance graph including a plurality of paths using the one or more processor devices from provenance data obtained from the computer systems and/or a network;
• sample the provenance graph to form a plurality of linear sample paths;
• calculate a regularity score for each of the plurality of linear sample paths using the one or more processor devices;
• select a subset of linear sample paths from the plurality of linear sample paths based on the regularity score;
• embed each of the subset of linear sample paths by converting each of the subset of linear sample paths into a numerical vector using the one or more processor devices;
• detect anomalies in the embedded paths to identify malicious process activities;
• and
• terminate a process related to the embedded path having the identified malicious process activities.