Provenance-based intrusion detection systems: A survey

M Zipperle, F Gottwalt, E Chang, T Dillon - ACM Computing Surveys, 2022 - dl.acm.org
Traditional Intrusion Detection Systems (IDS) cannot cope with the increasing number and
sophistication of cyberattacks such as Advanced Persistent Threats (APT). Due to their high …

Trustworthy data: A survey, taxonomy and future trends of secure provenance schemes

F Zafar, A Khan, S Suhail, I Ahmed, K Hameed… - Journal of network and …, 2017 - Elsevier
Data is a valuable asset for the success of business and organizations these days, as it is
effectively utilized for decision making, risk assessment, prioritizing the goals and …

Tactical provenance analysis for endpoint detection and response systems

WU Hassan, A Bates, D Marino - 2020 IEEE Symposium on …, 2020 - ieeexplore.ieee.org
Endpoint Detection and Response (EDR) tools provide visibility into sophisticated intrusions
by matching system events against known adversarial behaviors. However, current solutions …

Shadewatcher: Recommendation-guided cyber threat analysis using system audit records

J Zengy, X Wang, J Liu, Y Chen, Z Liang… - … IEEE Symposium on …, 2022 - ieeexplore.ieee.org
System auditing provides a low-level view into cyber threats by monitoring system entity
interactions. In response to advanced cyber-attacks, one prevalent solution is to apply data …

[PDF][PDF] You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis.

Q Wang, WU Hassan, D Li, K Jee, X Yu, K Zou, J Rhee… - NDSS, 2020 - kangkookjee.io
To subvert recent advances in perimeter and host security, the attacker community has
developed and employed various attack vectors to make a malware much stealthier than …

Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting

SM Milajerdi, B Eshete, R Gjomemo… - Proceedings of the …, 2019 - dl.acm.org
Cyber threat intelligence (CTI) is being used to search for indicators of attacks that might
have compromised an enterprise network for a long time without being discovered. To have …

Fear and logging in the internet of things

Q Wang, WU Hassan, A Bates, C Gunter - Network and Distributed …, 2018 - par.nsf.gov
As the Internet of Things (IoT) continues to proliferate, diagnosing incorrect behavior within
increasingly-automated homes becomes considerably more difficult. Devices and apps may …

Nodoze: Combatting threat alert fatigue with automated provenance triage

WU Hassan, S Guo, D Li, Z Chen, K Jee, Z Li… - network and distributed …, 2019 - par.nsf.gov
Large enterprises are increasingly relying on threat detection softwares (eg, Intrusion
Detection Systems) to allow them to spot suspicious activities. These softwares generate …

{AIRTAG}: Towards Automated Attack Investigation by Unsupervised Learning with Log Texts

H Ding, J Zhai, Y Nan, S Ma - 32nd USENIX Security Symposium …, 2023 - usenix.org
The success of deep learning (DL) techniques has led to their adoption in many fields,
including attack investigation, which aims to recover the whole attack story from logged …

[PDF][PDF] Towards a Timely Causality Analysis for Enterprise Security.

Y Liu, M Zhang, D Li, K Jee, Z Li, Z Wu, J Rhee, P Mittal - NDSS, 2018 - princeton.edu
The increasingly sophisticated Advanced Persistent Threat (APT) attacks have become a
serious challenge for enterprise IT security. Attack causality analysis, which tracks multi-hop …