Exploring Answer Set Programming for Provenance Graph-Based Cyber Threat Detection: A(…)
summary
Claims an ASP encoding of provenance graphs that supports nonmonotonic reasoning and encodes reachability, temporal and causal dependencies to do attack-path tracing, data-exfiltration detection, root-cause analysis and automated alert generation. Prototype uses the scasp solver (Kingo proved too slow) and runs case-study queries showing expressive, explainable pattern matches but hits state-space explosion and realtime/scalability limits on very large graphs. Roadmap includes a DSL-driven platform and using LLMs to generate detection patterns.
AI-written summary · about
chapters (9)
- 0:00ASP for cyber threat detection
- 1:47Academic motivation
- 3:56Provenance graphs in cybersecurity
- 6:04Why Answer Set Programming for reasoning
- 8:11Modeling graphs with ASP rules
- 10:21ASP rules for threat detection
- 12:49Implementation with scasp and scalability
- 14:54Future platform with DSL
- 16:16Q&A
related talks
24mUAV Compliance Checking using Answer Set Programming and Minimal Explanations to...
09mORTHRUS: Achieving High Quality of Attribution in Provenance-based Intrusion...
32mBuilding Intelligent Automatons with Semantic Reasoning
34mIt's Dangerous To SLSA Alone Out There! Take This Artifact Knowledge Graph!
28mSLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data
57mVariant analysis
27mChagu: Graph-Powered LLM Shielding and Anomaly Detection for Secure AI Pipelines
35mComplex Querying of Cyber Knowledge Graph for Robust Cyber Defense