A Context Is Worth a Thousand Lies: Evading Intrusion Detectors via Intelligent Context Distortion

Provenance-based Intrusion Detection Systems (PIDSes) have become one of the most promising solutions for detecting sophisticated attacks. However, many existing PIDSes can be evaded by approaches obfuscating malicious nodes among frequent benign events (i.e., gadgets) or replacing rare malicious events with frequent benign sequences. While effective against earlier PIDSes, those approaches largely overlook advanced node-level PIDSes, which leverage semantic information, temporal ordering, and graph representation learning to model the full context of nodes. This enriched view makes evasions that rely only on frequency of events less effective, as malicious nodes can still be distinguished by their semantic and structural relationships. Based on such an observation, we propose Contorter, an evasion framework that leverages the enhanced embeddings of node-level PIDSes to guide gadget generation and uncovers their blind spots for improving robustness. Specifically, Contorter identifies benign nodes of the same entity type as each malicious node, and selects one with a similar context that is labeled benign with high confidence by the target PIDS. It then replicates edges of the selected node around the malicious node to further align their contexts and hide the latter from the PIDS. We implement and evaluate Contorter on Darpa E3, OpTC, Unicorn, and StreamSpot datasets, and based on four exemplar node-level PIDSes. The results show that Contorter can reduce the recall to as low as 0 % (average 59 % reduction), while keeping the false positive rate mostly unchanged to avoid suspicion. Finally, compared to prior approaches, Contorter achieves over a 35 % greater reduction in recall under the same assumptions, while it requires about seven times fewer added edges.