DUPIN: Attack Learning Is Still Needed! Demonstrating Few-Shot after Unsupervised Pretraining Is A Nimble Forensics Learner

2026-08-31

AI Summary

DUPIN通过无监督预训练和少量标注攻击示例的微调，解决基于学习的攻击取证问题。

Abstract

We propose a novel approach to learning-based attack forensics called DUPIN. DUPIN performs unsupervised pre-training on an enormous amount of audit events in the form of provenance graphs. It then proceeds to a few-shot learning stage, leveraging a small number of labeled attack examples to fine-tune its detection capabilities. We pretrain DUPIN on up to 38 - 52 days of audit logs (7.3TB total) and evaluate it against various baselines on 25 APT campaigns across four different data sources, facilitating the scalable evaluation.

Problem

• attack forensics
• unsupervised pre-training
• few-shot learning
• audit events

Innovation

• unsupervised pre-training
• few-shot learning
• attack forensics
• provenance graphs