In this paper, we propose a novel intrusion detection system, OMNISEC, which utilizes a large-scale language model (LLM) to overcome the __T4312__ of existing Provenance-based Intrusion Detection Systems (PIDSes). Existing rule-based and learning-based PIDSes have the difficulties of dynamic modeling of rules, lack of attack samples, and excessive false positives, respectively. OMNISEC applies LLM and Retrieval-Augmented Generation (RAG) to anomaly detection-based systems to construct suspicious nodes and rare paths, and uses an external knowledge base to determine whether anomalies are real attacks. As a result, it reconstructs the attack graph to restore the entire process of the attack behavior. Experimental results show that OMNISEC outperforms existing state-of-the-art methods.
