<![CDATA[The telemetry being used by enterprise security operations is increasingly endpoint, network, identity and cloud-based, with each individually exposing only part of an adversary's actions, and multi-stage intrusions, like those stemming from advanced persistent threats, very hard to reconstruct from any single source. We present a systematic review of the methodological heritage from deterministic attack-graph generation to provenance-graph and log-based intrusion analytics, and graph neural network representation learning that spans twenty-six papers published over the past 20 years (2002-2022). It chronicles the journey from the relational and infrastructure-aware formulations of attack graph research to the inductive, attentional and relation-aware formulations of graph neural architectures, that emerged as a direct result of their scalability challenges, and the evolution of provenance-graph analytics from a purely sequence-based treatment of system behavior to a more explicit causal and relational treatment. On the basis of this synthesis, the review suggests a five-stage conceptual framework called ThreatWeave-X, which integrates multi-source signals from various sources into a single heterogeneous provenance graph, relational and attentional graph-neural embedding and a sequence-aware attention mechanism with an analyst feedback loop to rank candidate multi-stage attack paths. The review also outlines four cross-cutting challenges that appear in the reviewed literature that are still not completely addressed: 1) incompleteness of multi-modal heterogeneity handling, 2) scarcity of labels, 3) limited interpretability, and 4) inconsistent evaluation protocols, which all suggest directions for future empirical validation of the graph-neural multi-stage attack-path prediction.]]>
Copyrights © 2023
