TAPAS: An Efficient Online APT Detection with Task-guided Process Provenance Graph Segmentation and Analysis

Bo Zhang, Yansong Gao, Changlong Yu, Boyu Kuang, Zhi Zhang, Hyoungshick Kim, Anmin Fu

Advanced Persistent Threats (APTs) represent one of the most formidable challenges in modern cybersecurity, characterized by their sophisticated, stealthy, and long-duration attack campaigns. While **provenance analysis**, which constructs graphs from kernel-level audit logs to map system activities and dependencies, has emerged as a powerful technique for detecting APTs, its widespread adoption in production environments is severely hampered by scalability issues. The provenance graphs, detailing every system object and interaction, grow exponentially—often several gigabytes per day—requiring immense storage and computational resources for long-term maintenance and real-time analysis, which is critical for detecting attacks that can span months or even years.

AI review

Solid systems security work that actually grapples with the real problem—provenance graphs are unusable at scale, and TAPAS makes them usable. The 1806x storage reduction and 12.78s/GB throughput aren't marketing numbers; they're backed by DARPA TC benchmarks. Not a novel attack, but a genuine engineering contribution that could move provenance-based detection from academic toy to production reality.