  Advanced persistent threats (APT) are stealthy, sophisticated, and
unpredictable cyberattacks that can steal intellectual property, damage
critical infrastructure, or cause millions of dollars in damage. Detecting APTs
by monitoring system-level activity is difficult because manually inspecting
the high volume of normal system activity is overwhelming for security
analysts. We evaluate the effectiveness of unsupervised batch and streaming
anomaly detection algorithms over multiple gigabytes of provenance traces
recorded on four different operating systems to determine whether they can
detect realistic APT-like attacks reliably and efficiently. This report is the
first detailed study of the effectiveness of generic unsupervised anomaly
detection techniques in this setting.
