Provenance Graph Search via GNN Subgraph Embeddings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for subgraph matching in large provenance graphs face computational burdens due to their size and diversity, leading to inefficiencies and inaccuracies in identifying matching subgraphs, particularly when dealing with cyber attack scenarios.
Innovation Solution
A method involving graph simplification, versioning nodes, partitioning into overlapping subgraphs, and using order embeddings with GNNs to learn approximate subgraph relationships, ensuring efficient and accurate identification of matching subgraphs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If graph neural networks are applied to large provenance graphs to learn graph relationships, then the ability to capture relationships is improved, but the computational burden increases exponentially due to the expansion of receptive field
Solution Approach 1:
The patent divides the large provenance graph into multiple smaller subgraphs based on spatial proximity and temporal windows. This segmentation allows GNNs to process each subgraph independently with limited receptive field, avoiding exponential computational expansion while still capturing local relationships accurately. The subgraphs are then aggregated to form the complete graph representation.
Solution Approach 2:
The patent introduces temporal dimension by creating multiple versions of the provenance graph at different time points. Instead of processing the entire large graph at once, the system processes smaller temporal slices, effectively trading spatial complexity for temporal dimensionality. This allows relationship capture without exponential computational burden.
2Measurement precision
If the model depth of GNN is increased to capture relationships more effectively, then relationship capture ability is improved, but oversmoothing occurs leading to diminished expressivity
Solution Approach 1:
By segmenting the large provenance graph into smaller subgraphs, the patent enables effective relationship capture with shallow GNN models. Each subgraph is small enough that a shallow model (1-3 layers) can capture all necessary relationships without needing deep architectures that would cause oversmoothing. The segmentation naturally limits the maximum path length any node needs to traverse.
Solution Approach 2:
The patent processes multiple overlapping subgraphs that collectively cover the entire provenance graph. Instead of using a single deep model to capture all relationships, it uses multiple shallow models on partial subgraphs, achieving complete coverage through aggregation. This partial action approach avoids the oversmoothing problem of deep models while maintaining comprehensive relationship capture.
3Productivity
If provenance graphs are simplified by identifying anomalous interactions, then search efficiency is improved, but forensic tractability and integrity for general graph pattern search may be compromised
Solution Approach 1:
The patent simplifies the provenance graph by dividing it into temporal windows and spatial subgraphs, reducing the search space without removing nodes or edges. This structural segmentation maintains complete forensic information while improving search efficiency by limiting the scope of each search operation to relevant temporal and spatial boundaries.
Solution Approach 2:
The patent performs preliminary filtering of the search space by identifying relevant temporal windows and spatial subgraphs before executing the main search. This preliminary action reduces the effective search space to only those portions of the graph that could potentially contain matching patterns, improving efficiency without compromising the integrity of the complete graph data.
4Measurement precision
If node alignment methods are used for subgraph matching, then search accuracy is improved, but the coarse-grained nature of logs leads to erroneous connections and makes the method impractical
Solution Approach 1:
The patent segments the provenance graph into fine-grained subgraphs based on temporal windows and spatial proximity, creating smaller units for matching. This segmentation reduces the complexity of node alignment by limiting the search space to local neighborhoods, making accurate matching practical despite the coarse-grained nature of logs.
Solution Approach 2:
The patent applies local quality by performing node alignment only within local subgraphs rather than across the entire large graph. This local approach reduces erroneous connections because nodes are compared only with their spatial and temporal neighbors, improving practicality while maintaining accuracy through localized precise matching.
Data Source
AI summary
Example systems, methods, and apparatus are disclosed herein for ProvG-Searcher for querying large provenance graph repositories. A system for querying large provenance graph repositories including a server, a processor, and a memory storing instruction that, when executed by the processor, cause the processor to apply an embedding function and apply a subgraph prediction function.