Provenance-based intrusion detection systems: A survey

M Zipperle, F Gottwalt, E Chang, T Dillon - ACM Computing Surveys, 2022 - dl.acm.org
Traditional Intrusion Detection Systems (IDS) cannot cope with the increasing number and
sophistication of cyberattacks such as Advanced Persistent Threats (APT). Due to their high …

Are we there yet? an industrial viewpoint on provenance-based endpoint detection and response tools

F Dong, S Li, P Jiang, D Li, H Wang, L Huang… - Proceedings of the …, 2023 - dl.acm.org
Provenance-Based Endpoint Detection and Response (P-EDR) systems are deemed crucial
for future Advanced Persistent Threats (APT) defenses. Despite the fact that numerous new …

Shadewatcher: Recommendation-guided cyber threat analysis using system audit records

J Zengy, X Wang, J Liu, Y Chen, Z Liang… - … IEEE symposium on …, 2022 - ieeexplore.ieee.org
System auditing provides a low-level view into cyber threats by monitoring system entity
interactions. In response to advanced cyber-attacks, one prevalent solution is to apply data …

Kairos: Practical intrusion detection and investigation using whole-system provenance

Z Cheng, Q Lv, J Liang, Y Wang, D Sun… - … IEEE Symposium on …, 2024 - ieeexplore.ieee.org
Provenance graphs are structured audit logs that describe the history of a system's
execution. Recent studies have explored a variety of techniques to analyze provenance …

{PROGRAPHER}: An anomaly detection system based on provenance graph embedding

F Yang, J Xu, C **ong, Z Li, K Zhang - 32nd USENIX Security …, 2023 - usenix.org
In recent years, the Advanced Persistent Threat (APT), which involves complex and
malicious actions over a long period, has become one of the biggest threats against the …

{ATLAS}: A sequence-based learning approach for attack investigation

A Alsaheel, Y Nan, S Ma, L Yu, G Walkup… - 30th USENIX security …, 2021 - usenix.org
Advanced Persistent Threats (APT) involve multiple attack steps over a long period, and
their investigation requires analysis of myriad logs to identify their attack steps, which are a …

Privacy-aware traffic flow prediction based on multi-party sensor data with zero trust in smart city

F Wang, G Li, Y Wang, W Rafique… - ACM Transactions on …, 2023 - dl.acm.org
With the continuous increment of city volume and size, a number of traffic-related urban units
(eg, vehicles, roads, buildings, etc.) are emerging rapidly, which plays a heavy burden on …

AttacKG: Constructing technique knowledge graph from cyber threat intelligence reports

Z Li, J Zeng, Y Chen, Z Liang - European Symposium on Research in …, 2022 - Springer
Cyber attacks are becoming more sophisticated and diverse, making attack detection
increasingly challenging. To combat these attacks, security practitioners actively summarize …

{MAGIC}: Detecting advanced persistent threats via masked graph representation learning

Z Jia, Y **ong, Y Nan, Y Zhang, J Zhao… - 33rd USENIX Security …, 2024 - usenix.org
Advance Persistent Threats (APTs), adopted by most delicate attackers, are becoming
increasing common and pose great threat to various enterprises and institutions. Data …

Extractor: Extracting attack behavior from threat reports

K Satvat, R Gjomemo… - 2021 IEEE European …, 2021 - ieeexplore.ieee.org
The knowledge on attacks contained in Cyber Threat Intelligence (CTI) reports is very
important to effectively identify and quickly respond to cyber threats. However, this …