PGAid: An Interpreter for Provenance-Based Intrusion Detection Based on DeepAid

The Provenance Graph has been widely applied in host anomaly detection due to its ability to detect unforeseen threats, reveal correlations between host behaviors, and the superior performance offered by Graph Neural Networks. However, a barrier to the practical adoption of Provenance-based intrusion detection systems is the lack of interpretation. Unfortunately, existing interpretation approaches are proposed for either non-security domains or other kinds of anomaly detections like tabular, homogeneous graph or network intrusion detections, which are not suitable for Provenance-based intrusion detection systems and fail to satisfy special requirements in security domains. In this paper, we propose PGAid, a method aiming to interpret Provenance-based intrusion detection in security domains. Firstly, PGAid addresses the different interaction features between nodes in heterogeneous graphs by layering the provenance graph to be explained according to the types of source and destination nodes, segmenting it into different subgraphs for explanation. Then, we search for reference edge groups within each subgraph, adjusting the priority during the search process. Finally, we verified the effectiveness of our method from fidelity and stability, which respectively surpassed other baselines by 10% and 2-5%.