Host-based intrusion detectors often omit explicit time model assumptions
The claim
Current host-based intrusion detection systems rarely state clock, delivery, or evidence-integrity assumptions, undermining the validity of their conclusions
Published as: “SoK: Timestamps Are Not a Time Model: Rethinking Temporal Reasoning in Host-Based Intrusion Detection”
So what
Without explicit time models and evidence assumptions, campaign claims derived from host audit data cannot be reliably checked, highlighting a critical gap for future intrusion-detection research and tooling.
The five-minute version
Most host-based intrusion-detection systems and provenance-based analyses do not state an explicit time model or the evidence assumptions their campaign claims rely on, making those claims unreliable. The authors surveyed 1,003 security papers and 1,009 KRR papers, organized them into fifteen paradigm families, and found that none of the inspected systems states the full set of time-model and evidence assumptions together. They propose a five-component time-model framework, a six-question checklist, and a catalog of attack-reasoning patterns to make such assumptions explicit. The evidence is a systematic literature review, not new experiments, so the claim rests on the breadth of the surveyed corpus.
What they found 2
- No existing system states the full set of time-model and evidence assumptions together.
“None of the systems we inspected states these assumptions together.”
- Learned detectors report statistical scores without derivations, and re-evaluations show their benchmark accuracy is overstated under realistic conditions.
“Their output is a statistical score without a derivation behind it, and re-evaluations find that reported benchmark accuracy overstates detection quality once evaluation conditions become more realistic [20].”
What undercuts it the paper’s own results
- The paper notes that some systems (e.g., CrossGuard) use fixed windows and leave multi-stage correlation to an unspecified SIEM step, indicating partial but incomplete handling of temporal assumptions.
- The authors acknowledge that their own work introduces no new experiments and derives findings solely from existing literature, limiting empirical validation.
Stated limits 2
- Scope. We cover reasoning over host audit data and provenance graphs, together with the alert correlation and threat-intelligence work that feeds it. Network-flow classification, malware classification and cloud-log analytics are out of scope.
- As a systematization of knowledge, this paper introduces no new experiments, and its findings are derived from the literature and from the formalizations in Appendix D.
What’s new here 4
- A five-component time-model framework and a six-question checklist for making temporal and evidence assumptions explicit.
- A systematic survey of fifteen paradigm families covering both learned and symbolic host-audit detection approaches, with a detailed audit of their stated assumptions.
- A comparison of eleven symbolic temporal KRR formalisms and a learned baseline against nine precisely specified attack-reasoning patterns.
- An analysis of design constraints, theoretical limits, and open challenges for integrating temporal reasoning into host-based intrusion detection.
Artifacts & methods 6
- Five-component time-model frameworktheory
- Six-question checklist for time and evidence assumptionstheory
- Survey of fifteen paradigm familiesevaluation
- Catalog of nine attack-reasoning patternstheory
- Assessment of eleven symbolic formalisms and a learned baselineevaluation
- OpenAlex query datasetdataset