1) True Positive (TP) Counting
According to the paper, only graphs/nodes included in alerts should count towards TPs.
However, in the implementation, in ProvGraph.py (line 696), while alerts are raised for graphs in cache using Grubb's Test, these do not appear to be used further.
Instead, the cache keeps the top 20 graphs (by anomaly score) from the list of cache graphs merged with the graphs from the new time window, regardless of whether an alert was raised or not.
Additionally, main.py does its node-level TP counting from these graphs, as seen here, which adds nodes to the TP count in a loop running on the cache.
Could you clarify how this ensures only alert-triggering cases count towards TP?
Based on how node-level true positives are currently being calculated, we consider all graphs in the cache to be predicted graph-level positives (as any attack node in these graphs is bein considered a node-level true positive ) and those that contain attack-related process nodes to be graph-level true positives. Is this approach correct?
2) Cache Eviction Logic
Could you clarify whether the logic for cache updates using the energy of a hopset along with node retrieval using UUIDs is present in the code repository?
1) True Positive (TP) Counting
According to the paper, only graphs/nodes included in alerts should count towards TPs.
However, in the implementation, in ProvGraph.py (line 696), while alerts are raised for graphs in cache using Grubb's Test, these do not appear to be used further.
Instead, the cache keeps the top 20 graphs (by anomaly score) from the list of cache graphs merged with the graphs from the new time window, regardless of whether an alert was raised or not.
Additionally, main.py does its node-level TP counting from these graphs, as seen here, which adds nodes to the TP count in a loop running on the cache.
Could you clarify how this ensures only alert-triggering cases count towards TP?
Based on how node-level true positives are currently being calculated, we consider all graphs in the cache to be predicted graph-level positives (as any attack node in these graphs is bein considered a node-level true positive ) and those that contain attack-related process nodes to be graph-level true positives. Is this approach correct?
2) Cache Eviction Logic
Could you clarify whether the logic for cache updates using the energy of a hopset along with node retrieval using UUIDs is present in the code repository?