Advanced Persistent Threats (APTs) are stealthy cyberattacks that often evade detection in system-level audit logs. Provenance graphs model these logs as connected entities and events, revealing relationships that are missed by linear log representations. Existing systems apply anomaly detection to these graphs but often suffer from high false positive rates and coarse-grained alerts. Their reliance on node attributes like file paths or IPs leads to spurious correlations, reducing detection robustness and reliability. To fully understand an attack's progression and impact, security analysts need systems that can generate accurate, human-like narratives of the entire attack. To address these challenges, we introduce OCR-APT, a system for APT detection and reconstruction of human-like attack stories. OCR-APT uses Graph Neural Networks (GNNs) for subgraph anomaly detection, learning behavior patterns around nodes rather than fragile attributes such as file paths or IPs. This approach leads to a more robust anomaly detection. It then iterates over detected subgraphs using Large Language Models (LLMs) to reconstruct multi-stage attack stories. Each stage is validated before proceeding, reducing hallucinations and ensuring an interpretable final report. Our evaluations on the DARPA TC3, OpTC, and NODLINK datasets show that OCR-APT outperforms state-of-the-art systems in both detection accuracy and alert interpretability. Moreover, OCR-APT reconstructs human-like reports that comprehensively capture the attack story.

Recommendation systems have proved to be a compelling performance in overcoming the data overload problem in many domains, such as e-commerce, e-health, and transportation. Recommender systems guide users/clients to personalized recommendations based on their preferences. However, some recommendation systems are vulnerable to shilling attacks, which create rating biases or fake reviews that will eventually affect the authenticity and integrity of the generated recommendations. This survey comprehensively covers various shilling attack methods, including high-knowledge, low-knowledge attacks, and obfuscated attacks. It explores malicious review generators that generate fake text. In addition to that, this survey covers shilling attack detection methods such as supervised, unsupervised, semisupervised, and hybrid techniques. Natural Language Processing techniques are also thoroughly explored for fake text review detection using large language models (LLMs). A wide range of detection mechanisms incorporated in the literature is examined, such as convolutional neural network (CNN), long short term memory (LSTM)-based detectors for rating-based shilling attacks, and bidirectional encoder representation (BERT) and RoBERTa-based detectors for fake reviews that are accompanied by shilling attacks, aiming to offer insights into the evolving methods of shilling attack strategies and the corresponding advancements in the detection methods.

The stealthy and persistent nature of Advanced Persistent Threats (APTs) makes them one of the most challenging cyber threats to uncover. Several systems adopted the development of provenance-graph-based security solutions to capture this persistent nature. Provenance graphs (PGs) represent system audit logs by connecting system entities using causal relations and information flows. Hunting APTs demands the processing of ever-growing large-scale PGs of audit logs for a wide range of activities over months or years, i.e., multi-terabyte graphs. Existing APT hunting systems are typically memory-based, which suffers colossal memory consumption, or disk-based, which suffers from performance hits. Therefore, these systems are hard to scale in terms of graph size or time performance. In this paper, we propose MEGR-APT, a scalable APT hunting system to discover suspicious subgraphs matching an attack scenario (query graph) published in Cyber Threat Intelligence (CTI) reports. MEGR-APT hunts APTs in a twofold process: (i) memory-efficient extraction of suspicious subgraphs as search queries over a graph database, and (ii) fast subgraph matching based on graph neural network (GNN) and our effective attack representation learning. We compared MEGR-APT with state-of-the-art (SOTA) APT systems using popular APT benchmarks, such as DARPA TC3 and OpTC. We also tested it using a real enterprise dataset. MEGR-APT achieves an order of magnitude reduction in memory consumption while achieving comparable performance to SOTA in terms of time and accuracy.

In the realm of social network analysis and mining, recommendation systems have become indispensable algorithms in assisting users and industries in navigating the available contents or products in various domains and getting the most personalized recommendations to their interests and preferences. However, if the input data has been generated by malicious users, that poses a significant challenge to recommender systems' reliability and efficiency. One of the main threats that poses a challenge to recommender systems is shilling attacks. Shilling attacks tend to manipulate or poison the data in the systems' training phase, leading to biased or compromised recommendations. To address this challenge, we propose a robust recommender system using variational autoencoders (VAE) with Anomaly detection. Our model learns complex and non-linear patterns by exclusively focusing on the user-item interaction data, represented by a binary user-item interaction matrix, making it more resilient to classic shilling attacks. Moreover, our paper incorporates an anomaly detection mechanism, alongside the autoencoder, that analyzes the reconstruction errors, i.e. (MSE) between the original interactions and their reconstructed ones. We test the model on a real-world dataset and evaluate it using Recall@k and NDCG@k. This work enhances the trustworthiness and accuracy of recommendation algorithms, mainly when deployed in social network analysis and mining, where the potential for malicious data manipulation is a critical concern.

Akshat Shrivastava, Shrey Desai, Anchit Gupta, Ali Elkahky, Aleksandr Livshits, Alexander Zotov, Ahmed Aly. Proceedings of the 17th Conference of the European Chapter of the Association for Computational Linguistics. 2023.

Spoken language understanding (SLU) is a important field between the Speech and NLP community focused on converting a users’ speech utterance into an executable semantic parse. In order to facilitate open research in this space, we introduce the 1st Spoken Language Understanding challenge hosted at ICASSP 2023. We leverage the newly released SLU dataset STOP [1]. In this challenge, participants are asked to compete in 3 tracks of SLU relevant to the field (1) Quality: build the highest performance model (2) On-device: build the highest quality model under 15M parameters and (3) Low-resource: Achieve the highest quality in a low-resource setting. While participants have made significant strides in the challenge, there is still a long way to go in building data and compute efficient SLU models.

Arun Babu, Akshat Shrivastava, Armen Aghajanyan, Ahmed Aly, Angela Fan, Marjan Ghazvininejad. Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. 2021.

For improved spectrum utilization, the key technique for acquiring spectrum situational awareness (SSA) -- spectrum sensing -- is greatly improved by cooperation among the active spectrum users, as network size increases. However, the many cooperative spectrum sensing (CSS) schemes that have been proposed are based on the assumptions of accurate noise power estimates, characterizable variation in noise level and absence of false or malicious users. As part of a series of SSA research projects, in this research work, we propose a novel scheme for minimizing the effects of noise power estimation error (NPEE) and received signal power falsification (RSPF) by energy-based reliability evaluation. The scheme adopts the Voting rule for fusing multiple spectrum sensing data. Based on simulation results, the proposed scheme yields significant improvement, 68.2 - 88.8%, over the conventional CSS schemes, when compared on the basis of the schemes' stability to uncertainties in noise and signal power.