GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classification
Researchers have developed GRASP, a novel system for detecting advanced persistent threat (APT) attacks using graph-based anomaly detection. GRASP employs masked self-supervised classification to infer process executables from their two-hop provenance graph neighborhood, flagging misclassified processes as anomalies. This method captures behavior patterns without relying on predefined thresholds, making it robust against unknown activities and interference. Evaluations on the DARPA TC and OpTC datasets show GRASP outperforms existing systems in detecting anomalous behavior, including documented attacks and potentially malicious activities not previously labeled as such. AI
IMPACT Introduces a novel self-supervised learning approach for enhanced cybersecurity threat detection.