  As cyber-attacks become increasingly sophisticated and stealthy, it becomes
more imperative and challenging to detect intrusion from normal behaviors.
Through fine-grained causality analysis, provenance-based intrusion detection
systems (PIDS) demonstrated a promising capacity to distinguish benign and
malicious behaviors, attracting widespread attention from both industry and
academia. Among diverse approaches, rule-based PIDS stands out due to its
lightweight overhead, real-time capabilities, and explainability. However,
existing rule-based systems suffer low detection accuracy, especially the high
false alarms, due to the lack of fine-grained rules and environment-specific
configurations. In this paper, we propose CAPTAIN, a rule-based PIDS capable of
automatically adapting to diverse environments. Specifically, we propose three
adaptive parameters to adjust the detection configuration with respect to
nodes, edges, and alarm generation thresholds. We build a differentiable tag
propagation framework and utilize the gradient descent algorithm to optimize
these adaptive parameters based on the training data. We evaluate our system
based on data from DARPA Engagement and simulated environments. The evaluation
results demonstrate that CAPTAIN offers better detection accuracy, less
detection latency, lower runtime overhead, and more interpretable detection
alarms and knowledge compared to the SOTA PIDS.
