GRASP system uses graph-based anomaly detection for APT attacks

Researchers have developed GRASP, a novel system for detecting advanced persistent threat (APT) attacks using graph-based anomaly detection. GRASP employs masked self-supervised classification to infer process executables from their two-hop provenance graph neighborhood, flagging misclassified processes as anomalies. This method captures behavior patterns without relying on predefined thresholds, making it robust against unknown activities and interference. Evaluations on the DARPA TC and OpTC datasets show GRASP outperforms existing systems in detecting anomalous behavior, including documented attacks and potentially malicious activities not previously labeled as such. AI

Summary written by gemini-2.5-flash-lite from 1 source. How we write summaries →

IMPACT Introduces a novel self-supervised learning approach for enhanced cybersecurity threat detection.

RANK_REASON Academic paper detailing a new method for anomaly detection. [lever_c_demoted from research: ic=1 ai=1.0]

Read on arXiv cs.LG →

• GRASP
• APT attacks
• DARPA TC dataset
• OpTC dataset

• paper
• safety