Modern enterprises generate staggering volumes of system audit logs every day, and when those logs are transformed into provenance graphs—the dependency maps security teams use to trace cyberattacks—the results can contain tens of millions of nodes and edges. A single host may produce millions of audit records daily, imposing severe storage and computational burdens on defenders trying to detect advanced persistent threats, the stealthy, multi-stage campaigns conducted by well-resourced adversaries. A newly published framework called CSCProv promises to change that equation, shrinking these massive graphs by up to thirty times while preserving the attack evidence analysts need most.
The research, published in the journal Cybersecurity by a team from the Institute of Information Engineering at the Chinese Academy of Sciences and the University of Chinese Academy of Sciences, addresses a fundamental dilemma in provenance-based security analysis. Provenance graphs record causal interactions among system entities—processes, files, and network sockets—allowing analysts to reconstruct how an intrusion propagated from initial compromise through privilege escalation, lateral movement, and data exfiltration. But the sheer scale of these graphs makes analysis slow and expensive, and existing compression techniques often destroy the very evidence they are meant to protect.
The core insight behind CSCProv is that compression decisions must respect two dimensions at once. Structure-only methods identify repetitive topological patterns and merge them, but this can bury a critical anomaly inside a haystack of benign activity. The researchers illustrate the problem with a network reconnaissance scenario: an attacker scanning roughly 250 hosts with a tool like Nmap creates a large fan-out structure in which nearly all destination sockets look topologically identical. If one host is actually compromised, its socket spawns a distinct causal chain—receiving data and spawning a reverse shell—that a structure-driven compressor is likely to collapse into the aggregate, obscuring the attack lineage entirely.
Semantic-only compression suffers from the opposite weakness. In a Living-off-the-Land style attack against an Nginx web server drawn from the DARPA E3 CADETS dataset, a malicious backdoor script shares the same /var/www/html/ path prefix as thousands of benign web resources. A semantics-based compressor that merges nodes with similar attributes would homogenize the backdoor with ordinary file accesses, irrecoverably blending the malicious event into benign noise. Attackers deliberately exploit both blind spots, camouflaging malicious actions within legitimate binaries and repetitive system behavior.
CSCProv resolves this tension with a novel metric the authors call Causal-Semantic Consistency, or CSC. The framework computes two complementary representations for every node in a provenance graph. A structural embedding, produced by a topology-dominant graph convolutional network, captures each entity’s dependency patterns—its degree statistics, local connectivity, and node type—while deliberately excluding behavioral attributes. A semantic embedding, generated by a domain-adapted SecBERT language model, encodes the textual content of audit events, including command-line arguments, file paths, network metadata, and event types, which are then aggregated into node-level behavioral representations.
The CSC score itself is computed as the cosine similarity between joint embeddings that fuse both dimensions over each node’s localized k-hop provenance context. Two nodes are merged only when their combined score exceeds a configurable threshold, meaning they must be consistent in both dependency structure and behavioral semantics. Candidate pairs are processed in descending order of similarity, with merged nodes replacing their constituents and duplicate edges consolidated while preserving event counts. The researchers analyze the computational cost of the pipeline and note that restricting candidate generation by entity type and temporal context substantially reduces the number of pairwise comparisons in practice.
Evaluation on the DARPA Transparent Computing Engagement 3 dataset, spanning the CADETS, THEIA, CLEARSCOPE, FIVEDIRECTIONS, and TRACE subsets across FreeBSD, Linux, Android, and Windows platforms, demonstrates striking results. CSCProv achieves approximately a thirtyfold reduction in graph size on CADETS, outperforming baselines such as ProTracer at 3.5 times and TAPAS at 9.0 times, and exceeds thirtyfold average reduction across the other datasets. On CLEARSCOPE, a grouping-based competitor achieved slightly higher compression, but the authors argue this reflects CSCProv’s deliberately stricter merge criterion, which refuses to aggregate entities that are structurally similar yet semantically different.
Crucially, compression does not come at the cost of security fidelity. Using metrics including Attack Information Loss, Causal Information Loss, Attack Node Preservation, and Attack Path Completeness, the team shows that CSCProv consistently achieves the lowest information loss and preserves over 96 percent of attack-related nodes across all datasets. End-to-end attack propagation paths remain traceable and distinguishable after compression, meaning forensic analysts can still reconstruct how an attack unfolded. In a case study on the THEIA dataset, the framework actually improved detection: repetitive memory and file entities that had caused a false positive were consolidated, while the attack-related file /home/admin/clean, previously missed, was correctly flagged.
Downstream testing with three established detectors—THREATRACE, MAGIC, and UNICORN—confirmed that compressed graphs maintain or modestly improve detection accuracy while cutting detection time by 32.7 to 48.3 percent across datasets and frameworks. Ablation studies reinforced the necessity of the dual-dimensional design: structure-only compression performed poorly on Living-off-the-Land attacks where semantics are camouflaged, while semantics-only compression failed on reconnaissance scenarios where structure is nearly uniform. The full CSC model achieved the best results on every metric, and sensitivity analysis showed the framework remains robust across a range of similarity thresholds.
The authors acknowledge limitations: all evaluated datasets follow the DARPA Common Data Model schema, so generalization to other audit logging systems requires further validation, and the current implementation performs offline compression of host-level graphs, leaving streaming and cross-host analysis to future work. Even so, CSCProv represents a significant step toward making provenance-based defense practical at enterprise scale, offering a way to tame the data explosion without blinding the defenders who depend on it.
Subject of Research: Causal-semantic consistent compression of system provenance graphs for advanced persistent threat detection
Article Title: CSCProv: causal-semantic consistent provenance graph compression for attack detection
Article References: An, N., Zhu, Y., Yan, W., Wu, X., Jiang, B., Liu, J., & Lu, Z. (2026). CSCProv: causal-semantic consistent provenance graph compression for attack detection. Cybersecurity, 9(1), Article 216. https://doi.org/10.1186/s42400-026-00648-6
Image Credits: AI Generated
DOI: 10.1186/s42400-026-00648-6
Keywords: provenance graph, graph compression, attack detection, advanced persistent threats, cybersecurity, system audit logs, Causal-Semantic Consistency, DARPA E3 dataset, graph neural networks, SecBERT, forensic analysis, threat detection
Cite Scienmag News
APA MLA Chicago
Denise Maddox. (September 21, 2026). New Graph Compression Method Shrinks Cyberattack Data 30-Fold Without Losing Evidence. Scienmag. https://scienmag.com/new-graph-compression-method-shrinks-cyberattack-data-30-fold-without-losing-evidence/
Denise Maddox. “New Graph Compression Method Shrinks Cyberattack Data 30-Fold Without Losing Evidence.” Scienmag, 21 September 2026, https://scienmag.com/new-graph-compression-method-shrinks-cyberattack-data-30-fold-without-losing-evidence/. Accessed 21 September 2026.
Denise Maddox. “New Graph Compression Method Shrinks Cyberattack Data 30-Fold Without Losing Evidence.” Scienmag. September 21, 2026. https://scienmag.com/new-graph-compression-method-shrinks-cyberattack-data-30-fold-without-losing-evidence/
Copy citation Download RIS
Tags: advanced persistent threatsattack detectionCausal-Semantic ConsistencycybersecurityDARPA E3 datasetforensic analysisgraph compressionGraph Neural Networksprovenance graphSecBERTsystem audit logsthreat detection
