Tian Qiu

Endpoints are doorways to corporate data and are vulnerable by nature to attacks. To safeguard these assets, enterprises analyze audit logs - kernel-level records generated when software interacts with the underlying operating system - to identify intrusions. While traditional rule-based Intrusion Detection Systems (IDS) are increasingly ineffective due to alert fatigue, the industry remains hesitant to adopt state-of-the-art (SOTA) learning-based solutions. In this work, we first investigate this trust gap through extensive interviews with industry practitioners. We learn that this gap mainly arises from inherent concerns about system dependability in low-quality industrial data environments, including noise contamination in training data and adversarial manipulations in production data. Then, we build a robustness testbed to simulate such an environment and evaluate the performance of SOTA learning-based IDSs proposed in academia on both public benchmarks and our real-world industrial dataset. Drawing insights from these evaluations, we propose Cerberus, a novel three-stage robust endpoint threat detection system designed for practical deployment. From industrial perspectives, it features three tailored stages for noise reduction, threat capture, and false positive elimination, respectively. Cerberus has been validated to be comprehensively more effective on the proposed testbed against the SOTA learning-based IDS. Additionally, deploying Cerberus across nearly ten thousand end-points in a live production environment for a month demonstrates no missed detections while significantly reducing alert volume.

Single domain generalization (SDG) is a realistic yet challenging domain generalization scenario that aims to generalize a model trained on a single domain to multiple unseen domains. Typical SDG methods are essentially supervised data augmentation strategies, which tend to enhance the novelty rather than the diversity of augmented samples. Insufficient diversity may jeopardize the model generalization ability. In this paper, we propose a novel adversarial method, termed Unsupervised Diversity Probe (UDP), to synthesize novel and diverse samples in fully unsupervised settings. More specifically, to ensure that samples are novel, we study SDG from an information-theoretic perspective that minimizes the uncertainty coefficients between synthesized and source samples. Considering that the variation in a single source domain is limited, we introduce a regularization imposed on the auxiliary module that synthesizes variable samples, incorporated with uncertainty coefficients in an adversarial manner to complement the diversity. Subsequently, an available region is utilized to guarantee the samples' safety. For the network architecture, we design a simple probe module that can synthesize samples in several different aspects. UDP is an unsupervised and easy-to-implement method that solves SDG using only synthetic (source) samples, thus reducing the dependence on task models. Extensive experiments on three benchmark datasets show that UDP achieves remarkable results and outperforms existing supervised and unsupervised methods by a large margin in single domain generalization.