As Advanced Persistent Threat (APT) complexity increases, provenance data is increasingly used for detection. Anomaly-based systems are gaining attention due to their attack-knowledge-agnostic nature and ability to counter zero-day vulnerabilities. However, traditional detection paradigms, which train on offline, limited-size data, often overlook concept drift - unpredictable changes in streaming data distribution over time. This leads to high false positive rates. We propose incremental learning as a new paradigm to mitigate this issue. However, we identify FOUR CHALLENGES while integrating incremental learning as a new paradigm. First, the long-running incremental system must combat catastrophic forgetting (C1) and avoid learning malicious behaviors (C2). Then, the system needs to achieve precise alerts (C3) and reconstruct attack scenarios (C4). We present METANOIA, the first lifelong detection system that mitigates the high false positives due to concept drift. It connects pseudo edges to combat catastrophic forgetting, transfers suspicious states to avoid learning malicious behaviors, filters nodes at the path-level to achieve precise alerts, and constructs mini-graphs to reconstruct attack scenarios. Using state-of-the-art benchmarks, we demonstrate that METANOIA improves precision performance at the window-level, graph-level, and node-level by 30%, 54%, and 29%, respectively, compared to previous approaches.

翻译：随着高级持续性威胁（APT）复杂性的增加，溯源数据越来越多地用于检测。基于异常的系统因其不依赖攻击知识的特性以及应对零日漏洞的能力而受到关注。然而，传统的检测范式在离线、有限规模的数据上进行训练，常常忽略概念漂移——即流数据分布随时间发生的不可预测变化。这导致了高误报率。我们提出增量学习作为一种新范式来缓解这一问题。然而，在将增量学习整合为新范式的过程中，我们识别出四大挑战。首先，长期运行的增量系统必须对抗灾难性遗忘（C1）并避免学习恶意行为（C2）。其次，系统需要实现精确告警（C3）并重构攻击场景（C4）。我们提出了METANOIA，这是首个缓解因概念漂移导致高误报的终身检测系统。它通过连接伪边来对抗灾难性遗忘，转移可疑状态以避免学习恶意行为，在路径级别过滤节点以实现精确告警，并构建迷你图以重构攻击场景。使用最先进的基准测试，我们证明与先前方法相比，METANOIA在窗口级别、图级别和节点级别的精确度性能分别提高了30%、54%和29%。