CSCProv: causal-semantic consistent provenance graph compression for attack detection

Abstract Provenance graphs have become an important foundation for attack investigation and anomaly detection in enterprise systems. However, system audit logs generate massive numbers of events, resulting in extremely large provenance graphs that not only hinder efficient security analysis but also impose significant storage and computational overhead. Although existing graph reduction techniques can alleviate this problem to some extent, many approaches focus primarily on structural redundancy and often ignore the semantic differences between system entities, which may lead to the loss of attack-critical dependencies. To address this challenge, we present CSCProv, a causal-semantic consistent provenance graph compression framework designed to reduce graph size while preserving attack-relevant dependencies for efficient security analysis. The key idea is to perform node aggregation only when both structural dependency patterns and behavioral semantics remain consistent, ensuring that compression does not obscure critical attack propagation paths. To achieve this, we introduce a novel metric called Causal-Semantic Consistency (CSC), which jointly models topology-dominant event-induced provenance dependencies, referred to as causal dependencies in the provenance sense, and fine-grained behavioral semantics to guide graph compression. By integrating structural dependency information with security-specific semantic representations, CSCProv effectively eliminates redundant provenance structures while maintaining attack-critical contexts required for downstream security analytics. We evaluate CSCProv on the DARPA Engagement 3 (E3) dataset. Results show that CSCProv achieves up to 30× provenance graph reduction while preserving attack-critical dependencies. Despite aggressive compression, the compressed graphs maintain nearly identical detection performance with negligible accuracy degradation. In addition, CSCProv improves the efficiency of downstream attack detection, reducing detection time by 32.7–48.3% across different datasets and detection frameworks. These results demonstrate that CSCProv provides an effective balance between provenance graph reduction, attack information preservation, and security analysis efficiency. Similar content being viewed by others Introduction Advanced Persistent Threats (APTs) have become one of the most severe cybersecurity threats to modern enterprise systems Chen et al. (2014). Unlike traditional opportunistic attacks, APT campaigns are typically conducted by well-resourced adversaries who aim to maintain long-term, stealthy access to target environments. These attacks often unfold through multiple stages-including initial compromise, privilege escalation, lateral movement, and data exfiltration-allowing attackers to remain undetected while gradually expanding their control over compromised systems. Numerous real-world incidents have demonstrated that APT attacks can lead to significant financial losses, intellectual property theft, and large-scale service disruptions. Consequently, timely detection and analysis of APT activities have become a critical requirement for modern security monitoring systems (Bhattarai and Huang 2023; Jia et al. 2024). However, detecting APT attacks remains highly challenging due to their stealthy and multi-stage nature (Tang et al. 2022; Lv et al. 2026). Attackers often camouflage malicious activities within large volumes of legitimate system operations, making individual attack events difficult to distinguish from benign behavior. Meanwhile, modern enterprise systems generate massive volumes of system audit logs on a daily basis. Transforming these logs into system dependency structures often results in extremely large provenance graphs, introducing substantial storage overhead and management complexity. More importantly, APT campaigns typically involve complex causal relationships across multiple system entities, including processes, files, and network connections. These long-range dependencies often span numerous system events and entities, leading to severe dependency explosion during attack analysis. Traditional security monitoring techniques, such as signature-based intrusion detection or isolated event analysis, struggle to capture such complex interactions and therefore often fail to effectively identify sophisticated attack campaigns (Li and Chen 2024). To better capture such complex system dependencies, recent research has explored provenance-based security analysis, which constructs system-level provenance graphs from system audit logs. In these graphs, nodes represent system entities (e.g., processes, files, and network sockets), while edges capture causal interactions among them. By preserving fine-grained dependencies between system activities, provenance graphs allow security analysts to reconstruct attack propagation paths and uncover suspicious behaviors that would otherwise remain hidden. Despite these advantages, provenance graphs generated from real-world audit logs often contain millions of nodes and edges. The enormous graph size significantly increases both storage costs and analysis complexity, making efficient graph reduction an essential requirement for practical security investigation. To address the scalability challenges of provenance analysis, several studies have proposed graph reduction or summarization techniques to simplify large dependency graphs. Existing approaches typically focus on structural pruning, event filtering, or task-oriented segmentation to reduce graph size. While these methods can effectively improve analysis efficiency, they often overlook the preservation of attack-critical causal relationships or security-relevant semantic information. As a result, aggressive graph reduction may inadvertently remove important attack evidence or disrupt the causal paths required for accurate security analysis. These challenges highlight the need for security-aware provenance graph compression, where graph reduction must not only improve scalability but also preserve attack-critical dependencies essential for reliable downstream security analysis. In this paper, we propose CSCProv, a Causal-Semantic Consistent Provenance Graph Compression framework designed to reduce provenance graph complexity while preserving attack-critical dependencies for downstream security analysis. The key idea is to jointly consider both structural relationships and semantic consistency when compressing provenance graphs. Specifically, CSCProv first learns structural representations of nodes based on graph topology and captures semantic features derived from system event types. It then computes a causal-semantic consistency (CSC) metric to determine whether two nodes can be safely aggregated without disrupting attack propagation paths. By integrating topology-dominant structural features with fine-grained behavioral semantics, CSCProv avoids merging entities that participate in different stages of an attack campaign, thereby preserving the integrity of attack-propagation dependency chains. We evaluate CSCProv on the DARPA TC Engagement 3 (E3) dataset under multiple APT scenarios. Experimental results demonstrate that CSCProv achieves significant graph compression while preserving attack-critical dependencies and maintaining the effectiveness of downstream security analytics. These results indicate that CSCProv provides a practical and effective solution for scalable provenance-based security analysis. The main contributions of this paper are summarized as follows: - We identify and formalize the problem of security-aware provenance graph compression We show that effective compression for APT analysis must preserve both causal dependency structures and behavioral semantics, as relying solely on structural similarity or heuristic pruning can disrupt attack propagation paths and degrade forensic interpretability. - We propose Causal-Semantic Consistency (CSC), a novel dual-dimensional consistency model for provenance graph compression CSC jointly captures structural dependency similarity and behavioral semantic similarity between provenance subgraphs, enabling principled node aggregation that preserves attack-relevant dependencies while safely eliminating redundant benign behaviors. - We design and implement CSCProv, a CSC-guided provenance graph compression framework CSCProv enforces causal-semantic consistency during graph reduction to ensure attack-critical paths remain intact. Extensive evaluations on the DARPA Transparent Computing Engagement 3 (E3) datasets demonstrate that CSCProv achieves over 30\(\times \) graph reduction while consistently preserving attack propagation paths and maintaining high downstream detection accuracy, with significant improvements in analysis efficiency. Related work Provenance-based security analysis has been widely used for attack detection and forensic investigation by modeling dependencies among system entities to reconstruct attack propagation paths. However, the large scale of modern provenance graphs introduces significant challenges for efficient analysis due to high storage and computation overhead. To address this issue, provenance graph compression has emerged as a key direction, aiming to reduce graph complexity while preserving security-relevant structures and semantics. Existing studies can be broadly categorized into attack investigation methods and provenance graph compression techniques, including structure-based, semantics-based, and hybrid approaches. Provenance-based security analysis System provenance has become an important foundation for security monitoring and forensic investigation. By capturing fine-grained system interactions and organizing them into dependency graphs, provenance systems enable analysts to reconstruct causal relationships among system entities and trace the origins of malicious activities (Gehani and Tariq 2012; Pasquier et al. 2017; Pohly et al. 2012). Early work such as BackTracker (King and Chen 2003) first demonstrated how causal dependencies between system objects can be used to trace intrusions and reconstruct attack propagation paths. This work established the fundamental concept of using system execution provenance for security investigation. Building upon these collection systems, subsequent research has focused on improving automated attack investigation on provenance graphs. For example, PrioTracker (Liu et al. 2021) prioritizes nodes during graph exploration based on their causal importance, significantly accelerating the process of tracing attack origins in large provenance graphs. Other studies explore efficient causality analysis frameworks to improve attack reconstruction in enterprise-scale systems. More recently, researchers have explored learning-based approaches for analyzing provenance graphs. Instead of relying solely on rule-based investigation, these approaches leverage machine learning and graph representation learning techniques to detect anomalous behaviors in system interaction graphs. For example, PROGRAPHER (Yang et al. 2023) proposes a provenance graph embedding framework that detects anomalies by learning structural representations of system entities. Similarly, MAGIC (Jia et al. 2024) employs masked graph representation learning to detect advanced persistent threats (APTs) by modeling normal system behavior and identifying deviations in provenance graphs. Recent work also explores task-driven detection frameworks. For instance, TAPAS (Zhang et al. 2025) proposes a task-guided segmentation framework that partitions large provenance graphs into behaviorally meaningful subgraphs to support efficient APT detection. Although these approaches significantly improve detection capabilities, they still suffer from scalability challenges when operating on large provenance graphs containing millions of nodes and edges. Provenance graph compression To address the scalability challenges of provenance analysis, numerous studies have proposed techniques to reduce the size of provenance graphs while preserving important system dependencies. Existing approaches generally aim to eliminate redundant information, summarize repetitive behaviors, or aggregate semantically similar entities. Broadly speaking, these techniques can be categorized into structure-based and semantics-aware reduction approaches. Structure-based compression Structure-based compression methods aim to reduce the size of provenance graphs by exploiting repetitive structural patterns in system execution. The intuition behind these approaches is that many benign system activities generate highly similar dependency structures, which can be summarized without losing essential causal information. Early studies explored structural summarization by identifying frequently occurring dependency patterns and replacing them with compact representations. For example, LogApprox (Hassan et al. 2019) models common execution patterns probabilistically and compresses repeated dependency structures to reduce the size of provenance graphs. Similar ideas have been explored in pattern-based graph compression techniques, where frequent subgraph structures are identified and encoded using reference templates. Recent work has further improved this idea by constructing pattern dictionaries that store frequently occurring graph structures and reuse them during compression, enabling efficient reduction of large graph streams while maintaining structural relationships between entities Lee et al. (2024). More recent research has shifted from simple subgraph matching to higher-level structural representations. ProvGRP (Li et al. 2024) proposes a context-aware provenance graph reduction approach that identifies similar information-flow paths in the graph and merges redundant execution paths to eliminate behavior-unrelated events. Experimental results show that this approach can reduce provenance graph size by more than one order of magnitude while preserving key causal relationships. In addition, several studies investigate structural redundancy from the perspective of storage and encoding. For example, Dehydrator (Ying et al. 2024) introduces a hierarchical encoding strategy to eliminate structural redundancy in large provenance graphs and significantly reduce storage overhead. These approaches demonstrate that structural characteristics of provenance graphs can be effectively leveraged to improve the scalability of provenance-based security analysis. However, purely structure-based compression methods are often insensitive to the semantic differences between system entities. In security scenarios, structurally similar dependency patterns may correspond to completely different behaviors, which may lead to incorrect aggregation and loss of critical attack information. Semantics-based compression Semantics-based compression approaches reduce provenance graph size by leveraging attribute information associated with system entities and events. In provenance graphs, nodes and edges typically contain rich semantic attributes such as process names, file paths, system call commands, and network metadata. These semantic attributes provide important contextual information that can be exploited to identify behaviorally similar entities and aggregate redundant interactions. Early work explored attribute-based summarization techniques that group nodes according to semantic provenance types. For example, NodeMerge (Tang et al. 2020) proposes a template-based aggregation method that groups nodes exhibiting similar system call patterns, significantly reducing the size of provenance graphs. More recent research has incorporated semantic similarity analysis to improve aggregation accuracy. Instead of relying solely on structural patterns, these methods measure the similarity of node attributes or behavioral contexts to identify redundant entities. For instance, recent graph analysis approaches (Zhang et al. 2019; Zheng et al. 2024; Cai et al. 2021) employ clustering techniques to group nodes or substructures with similar semantic attributes and merge them into higher-level abstractions, effectively reducing redundant information in large graphs. Recent studies (Wang et al. 2025; Li et al. 2024) further integrate semantic similarity with machine learning techniques. For example, provenance graph reduction algorithms have been proposed to identify redundant substructures by computing semantic similarity between nodes and clustering them using algorithms such as K-means, thereby compressing the graph while preserving causal dependencies. Experimental results show that such semantic-aware reduction techniques Zeng et al. (2025) can significantly reduce graph size while maintaining high detection accuracy in security analysis tasks. Other recent work (Zeng et al. 2025, 2021; Kurniawan et al. 2022; Cui et al. 2025) focuses on enriching provenance graphs with higher-level semantic roles. Instead of treating audit events as simple system interactions, these approaches assign semantic labels representing the functional intent of system activities (e.g., configuration access, binary execution, or network communication). These semantic annotations can be used to filter low-risk interactions and remove redundant events, further reducing graph complexity while retaining security-relevant behaviors. Despite these advances, semantics-based compression techniques still face challenges in adversarial environments. Attackers often reuse legitimate binaries and system resources to disguise malicious activities, causing malicious and benign events to appear semantically similar. As a result, relying solely on semantic attributes may lead to incorrect aggregation and potential loss of critical attack information. Hybrid and domain-specific reduction Hybrid and domain-specific reduction approaches combine multiple analysis techniques to improve the scalability of provenance-based security analysis. Instead of relying solely on structural or semantic similarity, these methods integrate additional contextual information or task-specific objectives to guide the reduction process. Recent studies (Pohly et al. 2022; Hassan et al. 2020) explore learning-based approaches for provenance graph analysis. For example, graph representation learning techniques have been applied to extract compact representations from large provenance graphs and identify behaviorally similar substructures, which can then be aggregated to simplify the graph while preserving important causal relationships (Yang et al. 2023; Jia et al. 2024). Other work focuses on task-driven graph reduction tailored for specific security applications. For instance, several APT detection frameworks segment large provenance graphs into behaviorally meaningful subgraphs to facilitate efficient analysis and investigation (Zhang et al. 2025). By focusing on security-relevant activities and filtering routine system operations, these approaches effectively reduce the complexity of provenance graphs during analysis. Despite these advances, most existing approaches are designed for specific security tasks such as attack detection or query processing, rather than general-purpose provenance graph compression. Moreover, they often rely on either structural patterns or semantic attributes individually. In contrast, our approach jointly models both structural dependencies and semantic similarities to achieve more effective provenance graph compression. Motivation As advanced persistent threats (APTs) grow in sophistication, provenance-based system auditing has become a cornerstone for detecting long-lived, stealthy campaigns. However, the practical utility of this approach is severely hampered by the“data explosion”problem. High-fidelity auditing mechanisms, such as those employed in the DARPA Engagement 3 (E3) program, generate massive volumes of fine-grained event data (Xu et al. 2024). In practice, a single host may produce millions of audit records per day, which translate into provenance graphs containing tens of millions of nodes and edges. Such massive graphs impose substantial storage overhead and significantly increase the computational cost of downstream security analytics, including attack detection and forensic investigation (Wu et al. 2024). As a result, graph compression has become an indispensable preprocessing stage in many provenance-based security analysis frameworks Xu et al. (2024). Existing approaches predominantly fall into two categories: structure-based and semantics-based compression. Crucially, however, we argue and demonstrate that relying on either paradigm in isolation is fundamentally ill-suited for security applications. Advanced adversaries intentionally exploit the inherent blind spots of these one-dimensional algorithms, leading to a catastrophic loss of forensic fidelity. We illustrate this fundamental dichotomy through two representative attack scenarios drawn from the DARPA E3 datasets. The limitations of structure-based compression Conversely, structure-based approaches (e.g., frequent subgraph mining, grammar-based compression) focus primarily on identifying and replacing repetitive topological patterns, often initially disregarding node and edge labels. While this methodology theoretically preserves topological fidelity, it encounters significant hurdles in the specific context of APT detection, where critical attack signals are often subtle structural anomalies. Consider a typical network reconnaissance scenario as illustrated in Fig. 1a: an attacker utilizes a tool like Nmap to perform a sweeping intranet port scan against a /24 subnet (approximately 250 hosts), targeting SSH port 22. In the resulting provenance graph, this behavior forms a large fan-out structure, where a single scanning process connects to hundreds of destination sockets. From a purely topological perspective, these ~ 250 subgraphs are overwhelmingly repetitive; they form a large star structure where the vast majority of destination sockets are functionally identical“leaf”nodes, representing failed or benign connection attempts. Crucially, assume a single target host within this subnet is vulnerable and successfully compromised. This exploitation introduces a subtle but vital structural deviation: the socket node corresponding to the victim host is no longer a terminal leaf. Instead, it becomes the progenitor of a new, distinct causal chain-for instance, exhibiting subsequent recv data events, followed by an exec system call to spawn a reverse shell. A structural compression algorithm aiming for aggressive graph reduction faces a critical dilemma here. Driven by the high topological similarity across all 250+ socket nodes, the algorithm is highly likely to group them into a single, coarse-grained aggregate node to maximize compression ratio. In doing so, it inherently buries the critical“needle”-the single compromised host with its unique downstream causal path-within the“haystack”of benign scan targets. Consequently, the precise causal lineage of the attack is obfuscated within the aggregate node, rendering subsequent forensic analysis and attack reconstruction nearly impossible. The limitations of semantic-based compression Conversely, semantic-based approaches group nodes sharing similar attributes, assuming semantic similarity equates to behavioral redundancy. Such camouflage is particularly common in Living-off-the-Land (LotL) attacks, where adversaries intentionally abuse legitimate system binaries to blend malicious actions with normal activity. A prime example from the DARPA E3 CADETS dataset involves an Nginx web server backdoor attack, as illustrated in Fig. 1b. In a normal operational state, the nginx worker process frequently accesses a limited set of benign resources, such as web pages (.html, .css, .js in /var/www/html/) and log files (/var/log/nginx/access.log). These activities constitute the high-volume benign baseline. In the attack scenario, an adversary exploits a vulnerability in the web server to deploy and access a malicious backdoor script, such as /var/www/html/upload/backdoor.php, through the same legitimate nginx process. From a purely semantic perspective, the file path of the backdoor shares high textual similarity with benign web resources (e.g., sharing the /var/www/html/ prefix). A semantics-based compression engine, aiming to merge semantically redundant nodes, will aggressively collapse all files accessed by nginx within the web directory into a single, coarse-grained “Web Content” supernode. As a result, the specific causal lineage-the exact nginx operation that interacted with the malicious backdoor-is irrecoverably homogenized with thousands of benign file accesses. The semantic camouflage succeeds, and the specific forensic context essential for identifying the breach is lost. Bridging the gap: the proposed dual-compression approach These two scenarios reveal a fundamental tension in provenance graph compression: structural approaches tend to obscure attack-specific causal topologies by embedding them within repetitive graph patterns, whereas semantic approaches obscure attack-specific entity instances by merging them into semantically similar benign activities. This dichotomy highlights the inherent limitation of one-dimensional compression strategies, which fail to simultaneously preserve causal fidelity and semantic discriminability. To address this challenge, we propose a novel dual-compression framework, CSCProv, which jointly models structural dependencies and semantic attributes. Our key design principle enforces causal-semantic consistency: nodes are aggregated only when they exhibit high similarity in both semantic attributes and structural dependency relationships. By integrating these two dimensions, our approach effectively suppresses large volumes of redundant benign behaviors while rigorously preserving high-fidelity anomalous causal chains that are critical for accurate APT detection. System design In this section, we present the design of CSCProv, a dual-dimensional provenance graph compression framework aimed at reducing the scale of system provenance graphs while preserving attack-relevant causal dependencies. CSCProv is designed around the observation that safe compression should not rely on structural similarity or behavioral semantics alone. Instead, nodes are aggregated only when they are consistent in both causal dependency patterns and behavioral semantics. Figure 2 illustrates the overall workflow of CSCProv and its downstream detection evaluation. The workflow contains three stages: provenance graph preprocessing, CSC-guided graph compression, and downstream attack detection. The first stage constructs temporal provenance graphs from raw audit logs to provide standardized inputs for compression. The second stage is the core design of CSCProv, where graph entities are aggregated under the proposed Causal-Semantic Consistency constraint to reduce graph size while preserving attack-relevant dependencies. The third stage does not introduce a new detection model; instead, it is used to evaluate whether the compressed graphs produced by CSCProv can still support effective downstream attack detection. Problem definition We model system audit logs as a directed typed provenance graph \(G=(V,E)\), where V denotes the set of system entities and E denotes the set of dependency-inducing events between entities. Each node \(v \in V\) represents a system entity, such as a process, file, or network socket, and is associated with a node type \(\tau (v)\) and optional attributes A(v), such as process names, file paths, or command arguments. Each directed edge \(e=(u,v) \in E\) represents an audit event indicating that entity v depends on entity u through a system interaction. Terminology Following the convention of provenance-based security analysis King and Chen (2003), we use the term causal dependency to denote event-induced dependency relations among system entities. Specifically, an edge \(u \rightarrow v\) indicates that information or control may flow from u to v according to the semantics and temporal order of the observed audit event. This notion differs from statistical causal inference, counterfactual reasoning, or causal discovery. CSCProv does not estimate interventional effects or learn a structural dependency model; instead, its structural branch models the topology of provenance dependency relations and measures whether entities exhibit similar dependency patterns. Given a provenance graph G, the objective of graph compression is to construct a compressed graph \(G'=(V',E')\) by aggregating redundant entities while preserving security-relevant information. Let \(\pi : V \rightarrow V'\) denote the compression mapping from original nodes to compressed nodes. The compressed edge set \(E'\) is obtained by projecting each edge \((u,v)\in E\) to \((\pi (u),\pi (v))\) and consolidating duplicate edges induced by the mapping. Formally, we seek a compression mapping \(\pi \) that reduces the size of the resulting graph while preserving the information required for downstream security analysis. Specifically, the compressed graph should retain attack-relevant dependency chains and avoid merging entities with semantically distinct behaviors, even if they appear structurally similar. Therefore, node aggregation is permitted only when candidate nodes are consistent in both dependency structure and behavioral semantics. This requirement motivates the Causal-Semantic Consistency (CSC) principle that underlies CSCProv. Provenance graph preprocessing The preprocessing stage converts raw system audit logs into structured provenance graphs and performs normalization to reduce redundant events before compression. Provenance graph construction CSCProv operates on system provenance graphs constructed from raw audit logs, following the common practice adopted in provenance-based threat detection systems Cui et al. (2025). In the DARPA E3 dataset, system activities are represented using the Common Data Model (CDM), where system entities, such as processes, files, and network flows, are modeled as nodes, and system events, such as read, write, fork, and connect, are modeled as directed edges. The common node and edge types used in this work are summarized in Tables 1 and 2, respectively. For each audit event, CSCProv extracts the source entity, destination entity, event type, and timestamp to construct an event-induced dependency edge. The edge direction follows the information-flow semantics of the event. For example, a file read operation introduces an edge from the file node to the process node, while a process creation event introduces an edge from the parent process to the child process. Each edge is further associated with event attributes, such as timestamp and operation type, which are used in subsequent representation learning and compression. The resulting provenance graph records temporally ordered dependencies among system entities and provides the input for CSC-guided graph compression. Edge normalization and deduplication During preprocessing, CSCProv performs temporal edge normalization to remove repeated event records while preserving their frequency information. Each event-derived edge is represented as a quadruple: where u and v denote the source and destination nodes, op represents the operation type, and t denotes the timestamp. For a given time slice \(\mathcal {T}_i\), edges with the same source node, destination node, and operation type are consolidated into a single representative edge. Specifically, multiple edges \((u,op,v,t_j)\) satisfying \(t_j \in \mathcal {T}_i\) are merged into \(e'=(u,op,v,\mathcal {T}_i,c),\) where \(c=\left| \left\{ (u,\textrm{op},v,t_j)\,\big |\, t_j \in \mathcal {T}_i\right\} \right| \) denotes the number of repeated interactions between u and v with operation type op within the time slice \(\mathcal {T}_i\). This operation preserves the dependency relation between entities and provides a compact representation for subsequent CSC-guided compression. CSC-guided graph compression The main compression logic of CSCProv is driven by the CSC-guided aggregation strategy. Given a preprocessed provenance graph, CSCProv aggregates redundant nodes under the Causal-Semantic Consistency (CSC) constraint. The key principle is that two nodes can be merged only when they are consistent in both dependency structure and behavioral semantics. To implement this principle, CSCProv computes two complementary representations for each node. The structural representation captures dependency patterns from the graph topology, while the semantic representation captures behavioral information from node and event attributes. These representations are then integrated by the CSC metric to estimate whether candidate nodes are safe to aggregate. Nodes with high CSC scores are selected for compression, whereas nodes with inconsistent structural or semantic characteristics are kept separate to avoid losing attack-relevant evidence. The compression process consists of three main components: - (1) Structural embedding, which captures the similarity of node dependency patterns in the provenance graph; - (2) Semantic embedding, which evaluates the consistency of node attributes and behavioral semantics; - (3) Causal-Semantic consistency, which performs graph reduction based on the combined similarity score. Structural embedding To characterize the dependency patterns of provenance entities, we derive structural embeddings for each node using a topology-dominant Graph Convolutional Network (GCN). Its input consists of the normalized adjacency matrix of \(G_i\) and a lightweight structural feature matrix \(X_{\text {struct}}\), which includes node degree statistics, local connectivity features, and one-hot node type indicators. The structural feature matrix \(X_{\text {struct}}\) consists of topology-derived features, including degree statistics, local connectivity features, and node-type indicators. Since provenance graphs are heterogeneous by construction, node-type indicators provide schema-level constraints for distinguishing processes, files, and sockets during neighborhood aggregation. Fine-grained identity and behavioral attributes, such as process names, file paths, command arguments, and event contents, are excluded from \(X_{\text {struct}}\) and encoded by the semantic branch. Thus, the structural encoder focuses on dependency topology and entity roles in the provenance graph. Formally, let \(A_i\) denote the normalized adjacency matrix of \(G_i\). The structural embedding for node v is defined as: where \(X_{\text {struct}}\) is the structural feature matrix that encodes topology-related node attributes, including node degree, neighborhood connectivity patterns, and node-type indicators derived from the provenance graph. The resulting embedding \(S(v) \in \textbf{R}^{d_s}\) captures: - k-hop neighborhood structure. - Dependency interaction patterns. - Structural role of the entity in the provenance graph. This representation reflects how a node participates in causal flows, while fine-grained operational semantics are modeled separately in the semantic embedding branch. Semantic embedding While structural embeddings encode interaction topology, they do not capture the operational semantics embedded in system events. Attack activities often manifest through malicious command content or anomalous parameter usage rather than purely structural deviations. - (1) Edge-level semantic encoding For each edge \(e \in E_i\), we extract textual and contextual attributes associated with the corresponding audit event, including command-line arguments, file paths, network metadata, payload strings, and event types. For example, an execution-related event can be represented as: CSCProv adopts the publicly available SecBERT model (Liberato 2022), which is pretrained on cybersecurity-related corpora and uses a cybersecurity-oriented WordPiece vocabulary. As described in the Experimental Setup, the encoder is further adapted through continued pretraining with a masked language modeling objective on CDM event text extracted exclusively from the training split. Each constructed event description is fed into the domain-adapted SecBERT encoder, and the resulting contextualized embedding is used as the semantic representation of the corresponding edge. For system events with limited textual semantics, such as EVENT_FORK or EVENT_CLONE, CSCProv constructs lightweight template-based descriptions using the event type and participating entity roles, as illustrated by the following example: This strategy enables CSCProv to encode both text-rich and text-sparse audit events in a unified format. Formally, the semantic embedding of an edge e is computed as: where \(\operatorname {content}(e)\) denotes the constructed textual representation of the audit event, and \(M(e)\in \mathbb {R}^{d_m}\) denotes the resulting edge-level semantic embedding. The semantic embedding captures event-level behavioral information and is subsequently aggregated to obtain node-level semantic representations for CSC-based compression. - (2) Node-level semantic aggregation Since CSC-guided compression is performed at the node level, CSCProv aggregates edge-level event semantics into node-level behavioral representations. For each node v, let \(\operatorname {Inc}(v)\) denote the set of incident edges associated with v. The node-level semantic representation is obtained by aggregating the semantic embeddings of these incident events: where \(\operatorname {Inc}(v) \) denotes the set of edges incident to v. In this work, CSCProv adopts mean pooling as the aggregation strategy: where \(M(v)\in \mathbb {R}^{d_m}\) denotes the semantic representation of node v. Mean pooling provides a lightweight and parameter-free way to summarize the behavioral context of a node from its associated events, which is suitable for large-scale provenance graph compression. The resulting node-level semantic representation captures the behavioral context of an entity and characterizes its participation in system activities and information flows from an event-semantics perspective. It is then combined with the structural embedding to compute the Causal-Semantic Consistency score. Causal-semantic consistency CSCProv uses Causal-Semantic Consistency (CSC) as the merge criterion for security-aware graph compression. Instead of deciding whether two nodes can be merged based only on their individual attributes, CSC evaluates whether their localized provenance contexts are consistent in both dependency structure and behavioral semantics. This design reduces the risk of aggregating nodes that appear similar in topology but correspond to different system behaviors, or nodes that share similar semantics but participate in different dependency flows. Given two candidate nodes u and v, CSC jointly considers two complementary dimensions: - Structural Dependency Consistency, which measures whether the localized provenance subgraphs around u and v exhibit similar dependency patterns; - Behavioral Semantic Consistency, which measures whether the corresponding nodes and interactions express similar system-level behaviors. Thus, CSC elevates the merge criterion from isolated node similarity to localized causal-semantic context similarity, enabling CSCProv to compress redundant behaviors while preserving attack-relevant dependency evidence. - (1) Structural dependency consistency For each node v, let \(G_k(v)\) denote the k-hop localized provenance subgraph centered at v, and let \(\mathcal {V}_k(v)\) denote the set of nodes contained in this subgraph. Given two candidate nodes u and v, structural consistency measures the similarity between their localized dependency contexts: Directly comparing subgraph adjacency matrices is sensitive to graph size, node ordering, and local structural variations. Therefore, CSCProv represents each localized subgraph using the structural embeddings produced by the topology-dominant GCN described in section “Structural embedding”. The subgraph-level structural representation is obtained by pooling node embeddings within the localized context: where \(S(\textbf{x})\) denotes the structural embedding of node \(\textbf{x}\), and \(\operatorname {Pool}(\cdot )\) is implemented as mean pooling in our implementation. Then structural consistency is defined as: A higher \(\operatorname {SC}(u,v)\) indicates that the two nodes play similar roles within their localized provenance dependency contexts. Compared with node-level structural similarity, this subgraph-level formulation captures higher-order dependency patterns and provides a more reliable basis for deciding whether two nodes can be safely aggregated. - (2) Semantic behavioral consistency Semantic behavioral consistency evaluates whether two localized provenance contexts describe similar system behaviors. While structural consistency focuses on dependency topology, semantic consistency captures the operational meaning of the events associated with a node and its surrounding context, such as command execution, file access, process creation, and network communication. For each candidate node v, CSCProv derives a subgraph-level semantic representation from its k-hop localized provenance context \(M_k(v)\). Let \(\mathcal {V}_k(v)\) denote the set of nodes in \(M_k(v)\). Based on the node-level semantic embeddings defined in Section Node-Level Semantic Aggregation, the semantic representation of \(M_k(v)\) is computed as: where \(M(\textbf{x} )\) denotes the node-level semantic embedding of node \(\textbf{x} \), and \(\operatorname {Pool}(\cdot )\) is implemented as mean pooling in our implementation. Given two candidate nodes u and v, their semantic behavioral consistency is defined as: A higher \(\operatorname {BC}(u,v)\) indicates that the localized contexts of u and v exhibit similar behavioral semantics. This criterion prevents nodes with similar structural roles but different operational meanings from being merged, thereby preserving behavior-level evidence required for downstream security analysis. - (3) Info loss assessment After obtaining structural and semantic representations for localized provenance contexts, CSCProv estimates whether merging two candidate nodes would preserve the information required for security analysis. For each node v, we construct a joint representation by concatenating its structural and semantic context representations: where \(S_k(v)\) encodes the localized structure dependency around v, and \(M_k(v)\) encodes the behavioral semantics associated with the same context. To model the interaction between the two dimensions, CSCProv maps the concatenated representation into a unified consistency space: where \(f_\theta (\cdot )\) denotes a two-layer GCN encoder that propagates information over the provenance graph and produces the joint embedding \(z_v\) for node v. Finally, the Causal-Semantic Consistency between two nodes \(v_i\) and \(v_j \) is defined as the cosine similarity between their embeddings: A higher CSC score indicates that the two nodes are consistent in both localized dependency structure and behavioral semantics. CSCProv therefore uses this score to estimate the potential information loss introduced by node aggregation: A candidate merge is accepted only when the estimated merge loss is below a predefined threshold, or equivalently when the CSC score exceeds the compression threshold \(\delta \). This criterion allows CSCProv to aggregate redundant nodes while keeping structurally or semantically inconsistent entities separate, thereby preserving attack-relevant dependency evidence in the compressed graph. Compression algorithm Based on the CSC metric, CSCProv compresses a provenance graph through iterative node aggregation, as shown in Algorithm 1. Given a provenance graph \(G=(V,E)\) and a CSC threshold \(\delta \), CSCProv first derives structural and semantic representations for each node and computes CSC scores for candidate node pairs with compatible entity types and temporal contexts. Candidate pairs are then processed in descending order of their CSC scores. For a pair of nodes \((v_i,v_j)\), CSCProv accepts the merge only when \(\operatorname {CSC}(v_i,v_j)\ge \delta \). The two nodes are replaced by an aggregated node \(v_m\), and all incident edges are redirected to \(v_m\). Duplicate edges induced by the merge are consolidated, with their count and event attributes updated accordingly. The compression mapping \(\pi \) is also maintained to record the correspondence between original nodes and compressed nodes. The aggregation process proceeds until no candidate pair satisfies the CSC threshold. The output is a compressed provenance graph \(G'=(V',E')\) that reduces redundant structures while preserving dependency relations and behavioral semantics required for downstream security analysis. We further analyze the computational cost of CSCProv. Let \(n=|V|\) and \(m=|E|\) denote the number of nodes and edges in the input graph. Feature extraction and edge normalization require \(O(n+m)\) time. The GCN-based structural embedding costs \(O(L_gmd_s)\), where \(L_g\) is the number of GCN layers and \(d_s\) is the structural embedding dimension. Semantic encoding costs \(O(mT_{\textrm{LM}})\), where \(T_{\textrm{LM}}\) denotes the average cost of encoding one event sequence, and node-level semantic aggregation requires \(O(md_m)\) time. Let \(|\mathcal {C}|\) denote the number of candidate node pairs after applying entity-type and temporal-context constraints. Computing CSC scores requires \(O(|\mathcal {C}|d_z)\) time, where \(d_z\) is the joint embedding dimension, and sorting candidate pairs costs \(O(|\mathcal {C}|\log |\mathcal {C}|)\). Node merging and edge redirection can be implemented with a union-find structure, incurring an additional cost of approximately \(O(|\mathcal {C}|\alpha (n)+m)\), where \(\alpha (\cdot )\) is the inverse Ackermann function. Overall, the dominant costs of CSCProv come from semantic encoding, structural embedding, and CSC scoring over candidate pairs. Although the worst-case number of candidate pairs is \(O(n^2)\), CSCProv restricts candidate generation by entity type and temporal context, which substantially reduces the number of pairwise comparisons in practice. Downstream detection on compressed graphs The downstream detection stage is used to evaluate the utility of the compressed provenance graphs produced by CSCProv. CSCProv does not introduce a new attack detection model; instead, it serves as a security-aware graph compression module that can be placed before existing provenance-based detectors. Given a compressed graph \(G'=(V',E')\), the downstream detector extracts its required graph inputs, such as node types, edge types, temporal attributes, and compressed dependency relations, in the same format as used for the original provenance graph. This stage therefore evaluates whether the compressed graph preserves sufficient causal and semantic information for downstream security analysis. The detailed detector settings, training/testing protocol, and comparison with uncompressed baselines are described in section “RQ3: Impact of Graph Compression on Downstream Detection”. Evaluation In this section, we evaluate CSCProv on the DARPA Transparent Computing Engagement 3 (E3) datasets to assess its compression effectiveness, security-information preservation, downstream detection utility, and component contributions. Specifically, we answer the following research questions: RQ1 How effectively does CSCProv reduce provenance graph size? RQ2 Does CSCProv preserve attack-relevant causal dependencies in the compressed provenance graph? RQ3 How does CSCProv affect downstream attack detection performance on compressed graphs? RQ4 How do the key components and parameter settings of CSCProv contribute to compression quality and detection performance? Experimental setup Implementation and platform We implement CSCProv in Python, using PyTorch for graph representation learning and embedding computation. Provenance graphs are constructed and manipulated using efficient data structures, and all experiments are conducted within a unified framework to ensure fair comparison with baseline methods. The experimental platform consists of a workstation with an Intel Xeon CPU, 64 GB of memory, and an NVIDIA GPU used to accelerate neural network training and embedding computation. Semantic encoder setting The semantic encoder is initialized from the publicly available pretrained SecBERT model (Liberato 2022). To adapt it to provenance-event descriptions, we perform continued pretraining with a self-supervised masked language modeling objective on event-text sequences extracted exclusively from the training split. This procedure uses only event text and excludes attack labels, ground-truth annotations, and test-set data. The continued pretraining adapts SecBERT from its original long-form cybersecurity corpora to the short, structured CDM event descriptions used for event-level semantic encoding in CSCProv. Compression baselines We compare CSCProv with four representative provenance graph reduction methods: ProTracer, TAPAS, PrioTracker, and ProvGRP. These methods cover different reduction strategies, including structural reduction, semantic filtering, priority-based pruning, and graph grouping. For all methods, we use the same preprocessed provenance graphs as input and report compression ratio, compression time. Downstream detection protocol CSCProv does not introduce a new attack detection model. To evaluate whether the compressed graphs preserve sufficient information for downstream security analysis, we apply three existing provenance-based detectors, namely THREATRACE (Wang et al. 2022), MAGIC (Jia et al. 2024), and UNICORN (Han et al. 2020), to both the original and CSCProv-compressed provenance graphs. For each detector, we evaluate two matched settings. In the original-graph setting, the detector is trained and tested on the original provenance graphs using its standard architecture, input features, and training configuration. In the compressed-graph setting, CSCProv is first applied to both the training and testing graphs using the same compression threshold \(\delta \), after which the detector is trained and tested on the corresponding compressed graphs. We do not train a detector on the original graphs and directly test it on the compressed graphs, as this would introduce an input-distribution mismatch. The detector architectures, feature extraction procedures, and training hyperparameters are kept unchanged between the original-graph and compressed-graph settings. The compressed graphs retain the input schema required by the downstream detectors, including node types, edge types, timestamps, dependency directions, and aggregated edge attributes. Therefore, the observed performance differences primarily reflect the effect of graph compression rather than changes to the detector design. The detector–dataset coverage is determined by the configurations supported by the corresponding implementations and preprocessing pipelines. THREATRACE is evaluated on CADETS, THEIA, TRACE, and FIVEDIRECTIONS; MAGIC is evaluated on CADETS, THEIA, and TRACE; and UNICORN is evaluated on CADETS, THEIA, and CLEARSCOPE. The supported datasets differ across detectors because their implementations employ dataset-specific parsers, feature vocabularies, graph construction or partitioning procedures, and labeling pipelines. Accordingly, RQ3 evaluates each detector on its compatible E3 subsets, with all five subsets covered by at least one downstream detector. Evaluation metrics For RQ1, we evaluate compression effectiveness and efficiency using compression ratio and compression time. The compression ratio is computed as \(|V|/|V'|\), where |V| and \(|V'|\) denote the number of nodes before and after compression. For RQ2, we evaluate security-information preservation using Attack Information Loss (AIL), Causal Information Loss (CIL), Attack Node Preservation (ANP), and Attack Path Completeness (APC). For RQ3, we evaluate downstream detection utility using Precision, Recall, F1-score, and detection time. For RQ4, we conduct ablation studies on structural-semantic components, semantic encoding strategies, and the CSC threshold \(\delta \). Dataset We evaluate our approach using the DARPA Transparent Computing Engagement 3 (E3) Dataset DARPA (2018); Cheng et al. (2024), a widely used benchmark for provenance-based APT analysis. The dataset was released under the DARPA Transparent Computing Program, which aims to capture fine-grained system behaviors and enable comprehensive security analysis through whole-system provenance. Our evaluation includes five representative E3 subsets: CADETS (FreeBSD), THEIA (Linux), CLEARSCOPE (Android), FIVEDIRECTIONS (Windows), and TRACE (Linux), covering heterogeneous operating platforms and attack scenarios. These logs record system activities such as process creation, file operations, inter-process communication, and network connections. Each event is represented using the Common Data Model (CDM), which describes system entities, event attributes, and dependency relations in a unified format. Based on the CDM events, we construct provenance graphs in which nodes represent system entities, such as processes, files, and network sockets, and edges represent event-induced dependencies among them. The dataset includes multiple red-team attack scenarios that simulate real-world Advanced Persistent Threat (APT) behaviors, covering different stages of the attack lifecycle such as initial compromise, privilege escalation, lateral movement, and data exfiltration. Due to its large scale and complex dependency structure, the E3 dataset presents significant challenges for provenance-based security analysis, making it a suitable benchmark for evaluating the effectiveness and scalability of APT detection techniques (Table 3). RQ1: compression effectiveness and efficiency To evaluate the overall performance of CSCProv, we compare it with several representative provenance graph compression approaches, including ProTracer, TAPAS, PrioTracker, and ProvGRP. These methods represent different design philosophies such as structural reduction, semantic filtering, and priority-based pruning. We conduct experiments on multiple DARPA TC datasets, including CADETS, THEIA, CLEARSCOPE, FIVEDIRECTIONS, and TRACE. We first evaluate compression effectiveness by measuring the number of nodes and edges in the compressed provenance graphs, as well as the overall compression ratio compared with the original graphs. The compression ratio is defined as: where |V| and \(|V'|\) denote the number of nodes in the original graph and the compressed graph, respectively. Overall, CSCProv achieves strong graph reduction performance across all datasets and obtains the best or near-best compression ratios among the compared methods. As Fig. 3a is illustrated, on the CADETS dataset, CSCProv achieves approximately a compression ratio of 30\(\times \), which significantly outperforms ProTracer (3.5\(\times \)) and TAPAS (9.0\(\times \)). Similar trends are observed across the THEIA, CLEARSCOPE, FIVEDIRECTIONS and TRACE datasets, where CSCProv reduces the graph size by more than 30\(\times \) on average, while other approaches typically achieve compression ratios between 3\(\times \) and 28\(\times \). On CLEARSCOPE, ProvGRP achieves a slightly higher compression ratio than CSCProv. This exception is mainly related to the workload characteristics of CLEARSCOPE. As an Android-oriented subset, CLEARSCOPE contains many repetitive background application activities and homogeneous interaction patterns. Such workloads are favorable to grouping-based compression methods such as ProvGRP, which can aggressively merge structurally similar graph regions. In contrast, CSCProv applies a stricter merge criterion by jointly considering dependency structure and behavioral semantics. Therefore, it avoids merging entities that are structurally similar but semantically different, leading to a slightly lower compression ratio on this subset. This result shows that CSCProv favors security-preserving compression over purely aggressive graph reduction. We further evaluate compression efficiency by measuring the time required to perform graph compression on each dataset. Figure 3b shows the runtime comparison across different methods. ProTracer achieves the fastest runtime due to its lightweight structural reduction. TAPAS and PrioTracker introduce additional semantic and priority analysis, resulting in moderate runtime overhead. ProvGRP requires clustering operations over large graphs and therefore incurs the highest compression time. Although CSCProv introduces additional overhead from semantic encoding and causal-semantic consistency evaluation, it avoids expensive global clustering procedures and maintains stable runtime performance across datasets. The experimental results indicate that CSCProv achieves a favorable trade-off between compression effectiveness, semantic preservation, and computational efficiency for large-scale provenance graph analysis. RQ2: preservation of attack-critical paths The evaluation focuses on whether compressed provenance graphs preserve the security-critical information required for attack investigation. Since provenance graph compression may remove dependencies or merge intermediate entities, the analysis considers not only the retention of individual attack events and nodes, but also the completeness of end-to-end attack paths. We identify attack-related events and entities using the official ground-truth reports of the DARPA E3 datasets. Based on these annotations, we extract attack propagation paths from the original provenance graphs. These paths connect key attack stages, such as initial compromise, privilege escalation, lateral movement, and data exfiltration. Following prior provenance graph reduction studies such as ProvGRP (Li et al. 2024), we evaluate preservation quality using four metrics: Attack Information Loss (AIL), Causal Information Loss (CIL), Attack Node Preservation (ANP), and Attack Path Completeness (APC). - (1) Attack information loss (AIL) AIL measures the proportion of attack-related events that are removed during the graph compression process. This metric evaluates how well a compression method preserves critical attack behaviors in the provenance graph. Let \(E_{attack}\) denote the set of edges in the original provenance graph that are labeled as attack-related events, and let \(E'_{attack}\) represent the subset of these edges that remain in the compressed graph after graph reduction. The Attack Information Loss is defined as: where \(|E_{attack}|\) represents the total number of attack-related events in the original provenance graph, while \(|E'_{attack}|\) denotes the number of those events that are preserved after compression. The ratio \(\frac{|E'_{attack}|}{|E_{attack}|}\) therefore measures the fraction of attack events retained in the compressed graph. The AIL metric ranges from 0 to 1. A lower AIL value indicates that fewer attack-related events are lost during compression, meaning that the compressed graph better preserves attack behaviors. In the ideal case where all attack events are preserved, \(|E'_{attack}| = |E_{attack}|\) and \(\text {AIL}=0\). Conversely, higher AIL values indicate that more attack information has been removed, which may hinder downstream attack detection and investigation.In the DARPA datasets, attack-related events are identified according to the ground-truth attack annotations provided with each scenario. - (2) Causal information loss (CIL) CIL evaluates the extent to which causal relationships between system entities are removed during graph compression. Since provenance graphs explicitly model dependency relationships among system activities, preserving these causal edges is crucial for accurate attack tracing and forensic analysis. Let \(E_{causal}\) denote the set of edges in the original provenance graph that represent causal dependencies between system entities, and let \(E'_{causal}\) denote the subset of these edges that remain after compression. The Causal Information Loss is defined as: where \(|E_{causal}|\) is the total number of causal edges in the original graph, and \(|E'_{causal}|\) represents the number of causal edges preserved in the compressed graph. A lower CIL value indicates that more dependency relationships are retained, ensuring that important attack propagation paths remain analyzable. - (3) Attack node preservation (ANP) ANP measures how well attack-related system entities are preserved during the graph compression process. Since nodes corresponding to malicious processes, files, or network activities often play key roles in attack propagation, removing these nodes may significantly affect downstream detection and investigation tasks. Let \(V_{attack}\) denote the set of nodes in the original provenance graph that are associated with attack activities according to ground-truth annotations, and let \(V'_{attack}\) represent the subset of these nodes that remain in the compressed graph. The Attack Node Preservation is defined as: where \(|V_{attack}|\) is the total number of attack-related nodes in the original graph, and \(|V'_{attack}|\) is the number of those nodes preserved after compression. The ANP value ranges from 0 to 100%, where higher values indicate better preservation of attack-critical entities. - (4) Attack path completeness (APC) To further evaluate whether compressed provenance graphs preserve interpretable attack investigation capability, we introduce a metric called APC. Let \(\mathcal {P}_{\text {attack}}\) denote the set of ground-truth attack paths extracted from the original provenance graph. For an attack path \(P=(v_1,v_2,\ldots ,v_l)\), let \(\pi (P)=(\pi (v_1),\pi (v_2),\ldots ,\pi (v_l))\) denote its mapped sequence in the compressed graph, where \(\pi \) is the compression mapping from original nodes to compressed nodes. An attack path P is considered preserved if both of the following conditions are satisfied: - Traceability: Let \(\operatorname {red}(\pi (P))=(u_1,\ldots ,u_m)\) denote the sequence obtained by removing consecutive duplicate nodes from \(\pi (P)\). The path is traceable if every original node on P has a valid compressed representation and \((u_r,u_{r+1})\in E'\) for every \(r\in \{1,\ldots ,m-1\}\). We set \(T(P)=1\) if this condition is satisfied and \(T(P)=0\) otherwise. - Distinguishability: Let \(K(P)\subseteq \{v_1,\ldots ,v_l\}\) denote the subset of ground-truth attack-step nodes on path P. The compression mapping is required to be injective on K(P), i.e., $$\begin{aligned} \pi (v_i) \ne \pi (v_j) \quad \text {for all distinct } v_i,v_j \in K(P). \end{aligned}$$We set \(D(P)=1\) if this condition is satisfied and \(D(P)=0\) otherwise. The distinguishability condition operationalizes path ambiguity: a compressed node is considered ambiguous with respect to P if it contains two or more distinct ground-truth attack-step nodes from that path. Formally, APC is defined as Here, \(\mathcal {P}_{\textrm{attack}}\) denotes the set of ground-truth attack paths extracted from the original provenance graph, and \(\mathcal {P}_{\textrm{preserved}} \subseteq \mathcal {P}_{\textrm{attack}}\) denotes the subset of attack paths satisfying both the traceability and distinguishability conditions, i.e., A higher APC value indicates that the compressed provenance graph better preserves the completeness and interpretability of attack propagation paths. In particular, APC complements AIL by evaluating not only whether individual attack edges are retained, but also whether the full causal chain required for forensic reconstruction remains analyzable after node aggregation. After applying CSCProv to compress the provenance graphs, we compute these metrics by comparing the attack-related nodes and causal dependencies before and after compression. Figures 4, 5, 6, 7 report the preservation results across the evaluated datasets. CSCProv consistently achieves the lowest AIL and CIL across all evaluated datasets. This indicates that the proposed hybrid compression strategy effectively retains critical attack-related dependencies during graph reduction. In contrast, TAPAS segments provenance graphs based on task semantics, which may break certain causal dependencies between attack events, leading to moderate information loss. ProvGRP performs aggressive graph reduction through structural grouping, which results in higher loss of both attack information and causal relationships. In terms of attack entity preservation, CSCProv achieves the highest ANP and preserves over 96% of attack-related nodes across all datasets. This suggests that CSCProv can retain key attack entities, such as malicious processes, suspicious files, and network sockets, while still substantially reducing graph size. The improvement comes from the dual-dimensional merge criterion, which avoids aggregating entities that are structurally similar but behaviorally different. More importantly, CSCProv consistently achieves the highest APC among all compared methods. This indicates that the compressed graphs produced by CSCProv preserve not only individual attack nodes and edges, but also the completeness of end-to-end attack propagation paths. In other words, the key intermediate entities and ordered dependency chains remain distinguishable after compression, allowing analysts to reconstruct attack progression without significant ambiguity. The superior APC performance can be attributed to the joint modeling of structural dependencies and behavioral semantics. By enforcing causal-semantic consistency during node aggregation, CSCProv avoids merging entities that participate in different attack contexts, thereby reducing ambiguity in attack reconstruction and preserving the interpretability of compressed provenance graphs. Overall, these results demonstrate that CSCProv effectively balances graph reduction with the preservation of attack-critical information and attack path traceability, which are essential for accurate security investigation and forensic analysis. RQ3: impact of graph compression on downstream detection To evaluate whether CSCProv preserves attack-relevant information while improving analysis efficiency, we apply the downstream detectors to both the original and CSCProv-compressed provenance graphs and report their detection performance and runtime. The detector–dataset combinations follow the compatibility settings described in the Experimental Setup. Table 4 summarizes the detection performance before and after applying CSCProv. Overall, the compressed provenance graphs consistently maintain detection effectiveness while substantially reducing detection overhead. Across all datasets and detectors, Precision, Recall, and F1-score remain stable or modestly improve after compression, indicating that CSCProv successfully preserves the causal dependencies and behavioral semantics required for attack detection. For THREATRACE, CSCProv improves the F1-score on all four compatible datasets. The improvements are 1.18, 1.75, 1.22, and 1.80 percentage points on CADETS, THEIA, TRACE, and FIVEDIRECTIONS, respectively. The corresponding detection times decrease from 42 s to 23 s, 38 s to 21 s, 41 s to 27 s, and 45 s to 28 s. On TRACE, the improvement is primarily associated with higher precision, while recall decreases slightly from 99.00 to 98.32%. These results suggest that consolidating repetitive provenance contexts can reduce background interference in the local graph representations used by THREATRACE. For MAGIC, CSCProv also maintains or modestly improves detection performance. The F1-score increases from 95.48 to 96.84% on CADETS, from 98.50% to 99.67% on THEIA, and from 98.50 to 99.17% on TRACE. Meanwhile, detection time decreases by 48.3%, 41.8%, and 32.7%, respectively. Since MAGIC learns graph representations from provenance dependencies, these results indicate that CSCProv retains the structural and semantic information required by the detector while reducing the amount of graph data processed during representation learning. For UNICORN, the F1-score increases from 98.99 to 99.55% on CADETS, remains at 100% on THEIA, and increases from 99.00 to 99.62% on CLEARSCOPE. The corresponding detection times decrease from 37 s to 20 s, 34 s to 22 s, and 35 s to 21 s. These results show that CSCProv preserves the provenance patterns required by UNICORN while reducing its analysis overhead. The unchanged result on THEIA also illustrates that compression does not necessarily produce an accuracy gain when the original detector has already reached ceiling-level performance. In terms of efficiency, CSCProv consistently accelerates downstream detection across all datasets and detectors. Detection time is reduced by 32.7–48.3%, which can be attributed to the substantial reduction in graph size achieved during compression. Fewer nodes and edges need to be processed during graph traversal, dependency analysis, and representation learning, resulting in significantly lower computational overhead. Overall, these results demonstrate that CSCProv achieves an effective balance between graph reduction and information preservation. Even under aggressive compression, the resulting provenance graphs retain the critical information required for attack detection while substantially improving the efficiency of downstream security analytics. Case Study: Fig. 8 presents a representative detection case from the THEIA dataset. In the original provenance graph, the clean process is surrounded by several routine memory and file entities. In particular, M1, M2, and M3 participate in similar mmap interactions, while multiple library and configuration files are accessed through repetitive open dependencies. These entities introduce parallel local dependency structures around the same process. In this context, THREATRACE incorrectly classifies the benign memory entity M2 as anomalous and fails to detect the attack-related file /home/admin/clean. After applying CSCProv, the structurally and semantically consistent memory entities are aggregated into the compressed node Memory, while the routine file entities are aggregated into files. The parallel mmap and open dependencies induced by these entities are consolidated, with their event types and occurrence counts retained as aggregated edge attributes. In contrast, the attack-related processes, network flows, and /home/admin/clean remain distinguishable because their dependency contexts or behavioral semantics differ from those of the aggregated background entities. On the compressed graph, the compressed memory context is classified as benign, removing the spurious alarm associated with M2, while /home/admin/clean is correctly detected by THREATRACE. This example provides qualitative evidence that highly repetitive background dependencies can obscure attack-relevant signals in the local graph context used by THREATRACE. Consolidating these dependencies reduces their influence without eliminating the distinct attack-related branch. This effect is not universal. Its magnitude depends on the redundancy characteristics of the dataset and on how the downstream detector represents provenance neighborhoods. Detectors that are sensitive to repeated local structures may benefit more, whereas detectors with different representations or ceiling-level baseline performance may show smaller gains or unchanged accuracy. CSCProv is therefore primarily designed to preserve downstream detection utility and reduce computational overhead; occasional accuracy improvements should be interpreted as a dataset- and detector-dependent denoising effect. RQ4: ablation study To better understand the contribution of different components in CSCProv, we conduct three ablation studies: (1) evaluating the impact of structural and semantic compression modules, (2) analyzing the effectiveness of different semantic encoding strategies, (3) analyzing the sensitivity of the similarity threshold parameter. Ablation Study on Structural and Semantic Compression To quantify the contribution of each compression dimension, we evaluate three variants of CSCProv. CSCProv-S uses only structural consistency for node aggregation, with candidate similarity computed by the structural consistency score SC. CSCProv-M uses only behavioral semantic consistency, with candidate similarity computed by the semantic consistency score BC. In contrast, the full CSCProv model jointly integrates structural dependency patterns and behavioral semantics into a unified representation and computes the final Causal-Semantic Consistency score CSC for compression. Table 5 reports the compression ratio and detection performance of these variants. The results indicate that both components independently contribute to reducing graph size and improving detection effectiveness. CSCProv-S mitigates dependency explosion by merging redundant structural patterns while preserving causal execution paths. However, without semantic filtering, its compression capability remains limited. In contrast, CSCProv-M achieves stronger graph reduction by aggregating semantically similar events and removing low-risk activities, but the absence of structural constraints may weaken certain causal dependencies. These findings further support the motivation behind CSCProv. The CSCProv-S variant exhibits noticeably higher Attack Information Loss (AIL) in scenarios involving Living-off-the-Land (LotL) attacks, where malicious behaviors are semantically camouflaged within legitimate processes such as Nginx. Conversely, CSCProv-M performs poorly in large-scale reconnaissance scenarios, where structurally similar but functionally distinct entities (e.g., one compromised host versus many benign hosts) may be incorrectly merged, leading to the loss of critical causal paths. These limitations correspond to the challenges illustrated in Figure 1. In contrast, the full CSCProv model consistently achieves the best performance across all metrics and maintains the lowest AIL across attack scenarios. By jointly modeling causal structure and behavioral semantics, CSCProv effectively preserves attack-critical dependencies while eliminating redundant benign activities. This demonstrates that the hybrid design of CSCProv is essential for achieving both high compression ratios and reliable attack detection. Effectiveness of Different Semantic Encoding Strategies To evaluate the contribution of domain-specific semantic modeling, we compare three semantic encoding strategies: (1) TF-IDF, a traditional non-contextual text representation method; (2) frozen pre-trained BERT without domain adaptation; and (3) SecBERT after continued pretraining on CDM event text. Table 6 summarizes the results. Compared with TF-IDF, both BERT-based approaches achieve lower attack information loss and higher downstream detection performance, indicating that contextual language representations better capture behavioral similarities among system events. Furthermore, the domain-adapted SecBERT consistently achieves the best performance across all metrics. The cybersecurity-oriented pretraining of SecBERT provides representations for security-specific terminology, whereas continued pretraining on CDM event text further adapts the encoder to short command fragments, file paths, event templates, and execution-related patterns encountered in provenance data. As a result, semantically related events can be aggregated more accurately during graph compression, leading to improved information preservation and downstream detection effectiveness. These results demonstrate that domain-specific semantic adaptation contributes directly to the effectiveness of CSCProv and plays an important role in preserving attack-relevant behavioral semantics during provenance graph compression. Sensitivity to Similarity Threshold CSCProv determines whether two nodes can be merged based on a similarity threshold \(\delta \). A lower threshold allows more aggressive compression by merging loosely similar nodes, while a higher threshold enforces stricter similarity constraints to preserve more detailed provenance structures. To evaluate the robustness of CSCProv, we vary \(\delta \) within a reasonable range and measure its impact on compression effectiveness and attack information preservation. As shown in Fig. 9, when \(\delta \) is set low (e.g., 0.3–0.5), CSCProv achieves the highest compression ratios, reducing graph size by up to 38\(\times \). However, this aggressive merging slightly increases Attack Information Loss (AIL) to 0.22–0.28, as some critical causal dependencies may be inadvertently merged. In contrast, higher thresholds (e.g., 0.8–0.9) preserve attack-critical paths more effectively, yielding the lowest AIL around 0.09, but compression ratios decrease to 28–32×. Across the intermediate range (around δ = 0.7–0.8), CSCProv strikes a balance, achieving both substantial graph reduction (32–33×) and low AIL (0.11–0.16). This trend demonstrates that CSCProv’s dual-dimensional compression strategy is robust to variations in the similarity threshold: it can aggressively reduce graph size when needed, yet still preserve attack-related information, providing flexibility for different deployment scenarios. Discussion and limitations Effectiveness of dual-dimensional compression The ablation results confirm the necessity of dual-dimensional compression. CSCProv-S reduces redundant structural patterns but may merge behaviorally distinct entities when semantic constraints are absent. CSCProv-M improves graph reduction by aggregating semantically similar behaviors, but it may weaken attack-path preservation when structural dependency constraints are ignored. In contrast, the full CSCProv model jointly considers structural dependency consistency and behavioral semantic consistency through the CSC metric, achieving a better balance between graph reduction, attack information preservation, and downstream detection utility. Impact on security analysis A key concern of provenance graph compression in security scenarios is whether attack-relevant evidence remains traceable after graph reduction. Our evaluation shows that CSCProv achieves high attack node preservation, low attack information loss, and strong attack path completeness across all datasets. These results indicate that CSCProv preserves not only individual attack-related entities and edges, but also the ordered dependency chains required for forensic reconstruction. Moreover, downstream detection performance on CSCProv-compressed graphs remains comparable to that on original provenance graphs, while detection time is substantially reduced. This demonstrates that CSCProv can improve analysis efficiency without sacrificing the critical provenance information needed for attack investigation. Limitations Despite the promising results, CSCProv has several limitations. First, although our evaluation covers heterogeneous platforms in the DARPA E3 dataset, including FreeBSD, Linux, Android, and Windows systems, all evaluated subsets follow the Common Data Model (CDM) provenance schema. Therefore, the current results mainly demonstrate the effectiveness of CSCProv under a unified provenance representation. Its generalization to other audit logging systems, non-CDM schemas, or partially structured provenance formats requires further validation. Second, CSCProv relies on event-level semantic information to distinguish system activities. Short and template-like CDM event descriptions may provide insufficient context for rare or subtle behaviors, leading to less discriminative embeddings. Although template-based descriptions and continued pretraining on CDM event text partially mitigate this issue, a representation gap may still remain between SecBERT’s original long-form cybersecurity corpora and short provenance-event descriptions. Third, the current implementation performs offline graph compression and focuses primarily on host-level provenance graphs. Extending CSCProv to online compression, streaming provenance analysis, and cross-host or cross-domain attack investigation remains future work. Conclusion In this paper, we present CSCProv, a dual-dimensional provenance graph compression framework for reducing the scale of system provenance graphs while preserving attack-critical dependency structures. The key idea of CSCProv is to aggregate nodes only when they are consistent in both structural dependency patterns and behavioral semantics. To this end, we introduce the Causal-Semantic Consistency (CSC) metric, which jointly characterizes structural similarity and semantic similarity between provenance entities. CSCProv first constructs temporal provenance graphs from raw audit logs and then performs CSC-guided graph compression. The compression algorithm selectively aggregates redundant provenance entities while preserving meaningful system interactions that are important for attack investigation. The compressed graphs can be further used by downstream security analysis tasks, such as attack detection and forensic investigation. We evaluate CSCProv on the DARPA E3 dataset using multiple metrics, including compression effectiveness, attack information preservation, attack path completeness, and downstream detection performance. The experimental results show that CSCProv achieves substantial graph reduction while preserving attack-critical dependencies and maintaining detection effectiveness. In addition, operating on compressed graphs significantly improves the efficiency of downstream security analysis. Overall, CSCProv provides an effective solution for security-aware provenance graph compression. By jointly preserving dependency structures and behavioral semantics, CSCProv mitigates provenance graph explosion while retaining the information required for reliable attack detection and investigation. References Chen P, Desmet L, Huygens C (2014) A study on advanced persistent threats. In: De Decker B, Zúquete A (eds) Commun Multimed Secur. Springer, Berlin, Heidelberg, pp 63–72 Bhattarai B, Huang HH (2023) Prov2vec: learning provenance graph representation for unsupervised apt detection. ArXiv arXiv:abs/2310.00843 Jia Z, Xiong Y, Nan Y, Zhang Y, Zhao J, Wen M (2024) Magic: detecting advanced persistent threats via masked graph representation learning. In: Proceedings of the 33rd USENIX conference on security symposium. SEC ’24. USENIX Association. USA Tang B, Wang J, Yu Z, Chen B, Ge W, Yu J, Lu T (2022) Advanced persistent threat intelligent profiling technique: a survey. Comput Electr Eng 103:108261. https://doi.org/10.1016/j.compeleceng.2022.108261 Lv M, Zhang S, Liu H, Chen T, Zhu T (2026) APT-MCL: an adaptive apt detection system based on multi-view collaborative provenance graph learning. ArXiv arXiv:abs/2601.08328 Li L, Chen W (2024) Congraph: advanced persistent threat detection method based on provenance graph combined with process context in cyber-physical system environment. Electronics 13(5):945. https://doi.org/10.3390/electronics13050945 Gehani A, Tariq D (2012) SPADE: support for provenance auditing in distributed environments. In: Narasimhan P, Triantafillou P (eds) Lecture notes in computer science. Middleware 2012, vol. LNCS-7662, pp. 101–120. Springer, Montreal, QC, Canada. https://doi.org/10.1007/978-3-642-35170-9_6. Part 2: Tracing and Diagnosis. https://inria.hal.science/hal-01555544 Pasquier T, Han X, Goldstein M, Moyer T, Eyers D, Seltzer M, Bacon J (2017) Camflow: causal whole-system provenance capture and query. USENIX Security. pp 1135–1153 Pohly DJ, McLaughlin SE, Mcdaniel P, Butler KRB (2012) Hi-fi: collecting high-fidelity whole-system provenance. In: Asia-Pacific computer systems architecture conference. https://api.semanticscholar.org/CorpusID:5622944 King ST, Chen PM (2003) Backtracking intrusions. In SOSP 3:223–236 Liu Y, Zhang M, Li D, Saha K, Jin Y, Li L, Gu D (2021) Priotracker: accelerating provenance-based attack investigation by prioritizing the graph exploration. In: USENIX Security, pp 2625–2642 Yang F, Xu J, Xiong C, Li Z, Zhang K (2023) Prographer: an anomaly detection system based on provenance graph embedding. In: Proceedings of the 32nd USENIX conference on security symposium. SEC ’23. USENIX Association. USA Zhang B, Gao Y, Yu C, Kuang B, Zhang Z, Kim H, Fu A (2025) Tapas: an efficient online apt detection with task-guided process provenance graph segmentation and analysis. In: Proceedings of the 34th USENIX conference on security symposium. SEC ’25. USENIX Association, USA Hassan WU, Bates A, Marino D (2019) Logapprox: learn log-based approximation to accelerate security analytics. USENIX Security, pp 171–188 Lee H, Shin B, Choi D, Lim J, Bok K, Yoo J (2024) Graph stream compression scheme based on pattern dictionary using provenance. Appl Sci 14:4553. https://doi.org/10.3390/app14114553 Li J, Zhang R, Liu J (2024) ProvGRP: a context-aware provenance graph reduction and partition approach for facilitating attack investigation. Electronics 13(1):100. https://doi.org/10.3390/electronics13010100 Ying J, Zhu T, Chen T, Lv M (2024) Dehydrator: enhancing provenance graph storage via hierarchical encoding and sequence generation. IEEE Trans Inf Forensics Secur 20:7853–7866 Tang Y, Li Q, He Z, Zeng Y, Zhao Y (2020) Nodemerge: template based efficient data reduction for big provenance graph. CCS, pp 1329–1344 Zhang X, Liu H, Li Q, Wu XM (2019) Attributed graph clustering via adaptive graph convolution. ArXiv arXiv:abs/1906.01210 Zheng Y, Jia C, Yu J (2024) Attributed graph clustering under the contrastive mechanism with cluster-preserving augmentation. Inf Sci 681:121225. https://doi.org/10.1016/j.ins.2024.121225 Cai C, Wang D, Wang Y (2021) Graph coarsening with neural networks. In: International conference on learning representations. https://openreview.net/forum?id=uxpzitPEooJ Wang T, Tang W, Su Y, Li J (2025) Provenance graph-based deep learning framework for apt detection in edge computing. Appl Sci 15(16):8833. https://doi.org/10.3390/app15168833 Zeng Q, Liu S, Wu Y, Hara Y (2025) Semantic-aware provenance-based intrusion detection for edge systems Zeng J, Chua ZL, Chen Y, Ji K, Liang Z, Mao J (2021) Watson: Abstracting behaviors from audit logs via aggregation of contextual semantics. In: Proceedings 2021 network and distributed system security symposium Kurniawan K, Ekelhart A, Kiesling E, Quirchmayr G, Tjoa AM (2022) Krystal: knowledge graph-based framework for tactical attack discovery in audit data. Comput Secur 121:102828. https://doi.org/10.1016/j.cose.2022.102828 Cui M, Jiang Z, Li S, Ma C, Zhang K, Yang P, Feng H (2025) MGDA: a provenance graph-based framework for threat detection and attack scenario reconstruction. Comput Netw 274:111806 Pohly D, McDaniel P, Jaeger T (2022) CAQL: continuous analysis of query logs for database forensics. USENIX Security Hassan WU, Nitar SR, Bates A (2020) Hybrid provenance analysis: combining static and dynamic analysis for efficient attack reconstruction, pp CCS Xu B, Gong Y, Geng X, Li Y, Dong C, Liu S, Liu Y, Jiang BS, Lu Z (2024) ProcSAGE: an efficient host threat detection method based on graph representation learning. Cybersecurity 7(1):51 Wu W, Qiao W, Yan W, Jiang B, Liu Y, Liu B, Lu Z, Liu J (2024) Winemaking: Extracting essential insights for efficient threat detection in audit logs. CoRR arXiv:abs/2411.02775. 10.48550/ARXIV.2411.02775 2411.02775 Liberato M (2022) SecBERT: Analyzing reports with BERT-like models. M.sc. thesis in cyber security, University of Twente, Enschede, The Netherlands. https://essay.utwente.nl/93906/ Wang S, Wang Z, Zhou T, Sun H, Yin X, Han D, Zhang H, Shi X, Yang J (2022) Threatrace: detecting and tracing host-based threats in node level through provenance graph learning. IEEE Trans Inf Forensics Secur 17:3972–3987. https://doi.org/10.1109/TIFS.2022.3208815 Han X, Pasquier T, Bates A, Mickens JW, Seltzer MI (2020) Unicorn: Runtime provenance-based detector for advanced persistent threats. ArXiv arXiv:abs/2001.01525 DARPA: DARPA Transparent Computing Engagement 3 (E3) Dataset.(2018) https://github.com/darpa-i2o/Transparent-Computing. DARPA Transparent Computing Program Cheng Z, Lv Q, Liang J, Wang Y, Sun D, Pasquier T, Han X (2024) Kairos: practical intrusion detection and investigation using whole-system provenance. In: 2024 IEEE symposium on security and privacy (SP), pp 3533–3551. https://doi.org/10.1109/SP54263.2024.00005 Author information Authors and Affiliations Contributions Ning An participated in all the work, designed the framework and experiments, and wrote the manuscript. Yan Zhu implemented the CSCProv algorithm. Wenhao Yan contributed to the development of the semantic compression component. Xingying Wu performed data preprocessing and dataset preparation. Bo Jiang provided guidance on the overall framework design and participated in technical discussions. Junrong Liu designed the experimental protocol and conducted the controlled experiments. Zhigang Lu reviewed the manuscript and provided constructive suggestions for improving the presentation and technical details. All authors read and approved the final manuscript. Corresponding author Ethics declarations Competing interests The authors declare that they have no competing interests. Additional information Publisher's Note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations. Rights and permissions Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/. About this article Cite this article An, N., Zhu, Y., Yan, W. et al. CSCProv: causal-semantic consistent provenance graph compression for attack detection. Cybersecurity 9, 216 (2026). https://doi.org/10.1186/s42400-026-00648-6 Received: Accepted: Published: Version of record: DOI: https://doi.org/10.1186/s42400-026-00648-6