  Advanced Persistent Threats (APT) attacks have plagued modern enterprises,
causing significant financial losses. To counter these attacks, researchers
propose techniques that capture the complex and stealthy scenarios of APT
attacks by using provenance graphs to model system entities and their
dependencies. Particularly, to accelerate attack detection and reduce financial
losses, online provenance-based detection systems that detect and investigate
APT attacks under the constraints of timeliness and limited resources are in
dire need. Unfortunately, existing online systems usually sacrifice detection
granularity to reduce computational complexity and produce provenance graphs
with more than 100,000 nodes, posing challenges for security admins to
interpret the detection results. In this paper, we design and implement
NodLink, the first online detection system that maintains high detection
accuracy without sacrificing detection granularity. Our insight is that the APT
attack detection process in online provenance-based detection systems can be
modeled as a Steiner Tree Problem (STP), which has efficient online
approximation algorithms that recover concise attack-related provenance graphs
with a theoretically bounded error. To utilize STP approximation algorithm
frameworks for APT attack detection, we propose a novel design of in-memory
cache, an efficient attack screening method, and a new STP approximation
algorithm that is more efficient than the conventional one in APT attack
detection while maintaining the same complexity. We evaluate NodLink in a
production environment. The open-world experiment shows that NodLink
outperforms two state-of-the-art (SOTA) online provenance analysis systems by
achieving magnitudes higher detection and investigation accuracy while having
the same or higher throughput.
