Endpoints are doorways to corporate data and are vulnerable by nature to attacks. To safeguard these assets, enterprises analyze audit logs - kernel-level records generated when software interacts with the underlying operating system - to identify intrusions. While traditional rule-based Intrusion Detection Systems (IDS) are increasingly ineffective due to alert fatigue, the industry remains hesitant to adopt state-of-the-art (SOTA) learning-based solutions. In this work, we first investigate this trust gap through extensive interviews with industry practitioners. We learn that this gap mainly arises from inherent concerns about system dependability in low-quality industrial data environments, including noise contamination in training data and adversarial manipulations in production data. Then, we build a robustness testbed to simulate such an environment and evaluate the performance of SOTA learning-based IDSs proposed in academia on both public benchmarks and our real-world industrial dataset. Drawing insights from these evaluations, we propose Cerberus, a novel three-stage robust endpoint threat detection system designed for practical deployment. From industrial perspectives, it features three tailored stages for noise reduction, threat capture, and false positive elimination, respectively. Cerberus has been validated to be comprehensively more effective on the proposed testbed against the SOTA learning-based IDS. Additionally, deploying Cerberus across nearly ten thousand end-points in a live production environment for a month demonstrates no missed detections while significantly reducing alert volume.

@inproceedings{XuQGJMWZGWZ26,
  title = {Cerberus: Robust Endpoint Threat Detection in Practice},
  author = {Zhiwei Xu and Tian Qiu and Haohao Gao and Wei Jiao and Qichen Ma and Jingli Wang and Jiaxiang Zhao and Jiabao Gao and Hai Wan and Xibin Zhao},
  booktitle = {FSE},
  year = {2026},
  doi = {10.1145/3803437.3805249}
}