A Trust Evaluation and Concept Drift-Based Approach for Dynamic APT Evasion Detection

Kernel-level APT audit methods based on prove-nance graphs have garnered widespread attention for their excellent traceability in detecting APT attacks within complex system environments. However, existing detection schemes only consider static attack behaviors and cannot reveal dynamically constructed attack primitives (e.g., concept drift) by adversaries. In real APT scenarios, adversaries often inject a large number of unrelated benign entities into the provenance graph entity flow to evade detection. To address this issue, this paper presents a dynamic APT evasion behavior detection model based on trust evaluation. It investigates methods for analyzing trustworthy interactions of provenance entities using temporal associations in dynamic environments and employs D-S evidence theory for APT evasion behavior analysis to defend against concept drift attacks in provenance graphs. Specifically, the dynamic APT evasion behavior detection model based on trust evaluation comprises two tasks: (i) temporal association, which involves embedding timestamps and sequential association markers into each POI alarm point; (ii) trust evaluation, which aims to suppress the continuous sequence of distributed untrustworthy entities.