DROPS

Document

DOI: 10.4230/OASIcs.NINeS.2026.1

Tidal: Tackling Concept Drift in Provenance-Based Advanced Persistent Threats Detection

Authors: Yajie Zhou, Nengneng Yu, Tuo Zhao, and Zaoxing Liu

Published in: OASIcs, Volume 139, 1st New Ideas in Networked Systems (NINeS 2026)

Abstract

Advanced Persistent Threats (APTs) pose significant challenges to cybersecurity due to their evolving nature and ability to evade detection. This paper introduces Tidal, a novel provenance-based intrusion detection system (PIDS) that is specifically designed to address concept drift in APT detection. Tidal designs a modified Transformer architecture tailored for transfer learning, including a Multi-head Transformer (MHT) with shared layers for learning common knowledge and task-specific head layers for learning unique patterns. The system uses a pre-training and fine-tuning workflow to achieve high post-drift adaptation and pre-drift retention accuracy. Additionally, Tidal customizes its data embedding for detection on flexible audit log lengths and computes entity relevance scores alongside classified attacks to aid in attack investigation. We evaluate Tidal by simulating concept drift scenarios with real-world datasets. Results demonstrate that compared to state-of-the-art detection systems, Tidal achieves an average of 27% higher recall and 31% higher precision with only half of new training data for post-drift adaptation accuracy.

Cite as

Yajie Zhou, Nengneng Yu, Tuo Zhao, and Zaoxing Liu. Tidal: Tackling Concept Drift in Provenance-Based Advanced Persistent Threats Detection. In 1st New Ideas in Networked Systems (NINeS 2026). Open Access Series in Informatics (OASIcs), Volume 139, pp. 1:1-1:28, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026)

Copy BibTex To Clipboard

@InProceedings{zhou_et_al:OASIcs.NINeS.2026.1,
  author =	{Zhou, Yajie and Yu, Nengneng and Zhao, Tuo and Liu, Zaoxing},
  title =	{{Tidal: Tackling Concept Drift in Provenance-Based Advanced Persistent Threats Detection}},
  booktitle =	{1st New Ideas in Networked Systems (NINeS 2026)},
  pages =	{1:1--1:28},
  series =	{Open Access Series in Informatics (OASIcs)},
  ISBN =	{978-3-95977-414-7},
  ISSN =	{2190-6807},
  year =	{2026},
  volume =	{139},
  editor =	{Argyraki, Katerina and Panda, Aurojit},
  publisher =	{Schloss Dagstuhl -- Leibniz-Zentrum f{\"u}r Informatik},
  address =	{Dagstuhl, Germany},
  URL =		{https://drops.dagstuhl.de/entities/document/10.4230/OASIcs.NINeS.2026.1},
  URN =		{urn:nbn:de:0030-drops-255867},
  doi =		{10.4230/OASIcs.NINeS.2026.1},
  annote =	{Keywords: Advanced Persistent Threat (APT), Provenance-based Intrusion Detection (PIDS), Concept Drift, Transfer Learning, Machine Learning for Security}
}

Search Results

Documents authored by Liu, Zaoxing

Tidal: Tackling Concept Drift in Provenance-Based Advanced Persistent Threats Detection

Abstract

Cite as

Thanks for your feedback!

Could not send message