Not All Relations Are Equal: Relation-Balanced and Calibrated Graph Learning for Provenance-Based Intrusion Detection

arXiv:2609.16462 · cs.CR, cs.LG · Submitted 2026-09-15 · Read on arXiv

cs.CR, cs.LG

Submitted: 2026-09-15

Updated: 2026-09-19

Comments: 6 pages

Code: https://github.com/Jiex2001/RECAL

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

Calibration — 22× in this paper · explained in 7 episodes
Provenance — 22× in this paper · explained in 3 episodes
Trace — 15× in this paper · explained in 2 episodes
Reconstruction Error — 10× in this paper · explained in 2 episodes
Embeddings — 6× in this paper · explained in 2 episodes
Advanced Persistent Threat — 5× in this paper
Graph Construction — 4× in this paper · explained in 3 episodes
F1 Score — 3× in this paper · explained in 3 episodes
False Positive Rate — 3× in this paper
Ablation — 2× in this paper · explained in 1 episode
Ablation study — 2× in this paper · explained in 1 episode
Adam — 2× in this paper · explained in 2 episodes
Aggregation — 2× in this paper · explained in 1 episode
Relation-Calibrated Detection — 2× in this paper
Representation Learning — 2× in this paper · explained in 2 episodes
Alert Fatigue — 1× in this paper · explained in 1 episode
Computational overhead — 1× in this paper · explained in 2 episodes
Concept Drift — 1× in this paper · explained in 4 episodes
Conference on Computer and Communications Security — 1× in this paper
Fidelity — 1× in this paper · explained in 2 episodes
Heterogeneous Graph — 1× in this paper · explained in 2 episodes
K-Nearest Neighbor — 1× in this paper
Network and Distributed System Security Symposium — 1× in this paper
With Relation-Balanced Learning — 1× in this paper

Sources

Related papers