DI-GAE: A Dynamic and Resource-Efficient Attack Detection Framework with Incremental Learning and Graph Autoencoders

Data-driven deep learning methods have made significant strides in attack detection, with provenance graph analysis based on audit logs emerging as a key approach for identifying complex threats. However, the inherent "redundancy" and "dynamic variability" in audit logs pose two major challenges: redundant data leads to inefficient use of computational resources during model training, and shifts in data distribution over time can degrade detection performance. To address these challenges, we propose DI-GAE, a framework that is both resource-efficient and dynamically adaptive. We initially train a graph autoencoder on benign data. As data distribution changes, Behavior Pattern Scores (BPS) are applied at the time-window level to probe new behavioral patterns while filtering out redundant benign data, allowing for dynamic updates through incremental learning. Additionally, we integrate data replay and Elastic Weight Consolidation (EWC) strategies to ensure the model retains existing patterns while learning new ones. Experimental results demonstrate that DI-GAE not only conserves resources and adapts dynamically but also achieves detection performance comparable to state-of-the-art frameworks. Furthermore, we provide a detailed analysis of the model’s components, illustrating its ability to learn new patterns and maintain existing knowledge.