Cutting the Fuse: Actionable APT Attack Blocking in Provenance-based IDS
PROVX is an explanation framework for Graph Neural Networks (GNNs) used in security models on provenance graphs. It uses counterfactual logic to find minimal graph structures that, if removed or changed, would flip a malicious prediction to benign. This provides human-understandable explanations for GNN security alerts and improves detection performance through a closed-loop feedback system.