SoK: History is a Vast Early Warning System: Auditing the Provenance of System Intrusions

Inam, Muhammad Adil; Chen, Yinfang; Goyal, Akul; Liu, Jason; Mink, Jaron; Michael, Noor; Gaur, Sneha; Bates, Adam; Hassan, Wajih Ul

doi:10.1109/sp46215.2023.10179405

Cited by 8 publications

(2 citation statements)

References 98 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Provenance analysis: Provenance analysis has been studied by a large body of work in recent years [9][10][11][12][13][14][15][16][17][18][19][20][21][22][23][24][25]. Recent survey papers [24,25] summarize multiple approaches conducted in the provenance tracking and dependency analysis according to their categorizations. Multiple attack detection approaches [23,[44][45][46][47] have been proposed to detect APT campaign effectively.…”

Section: Related Workmentioning

confidence: 99%

“…System forensic analysis also known as system provenance analysis [9][10][11][12][13][14][15][16][17][18][19][20][21][22][23][24][25] is an effective technique to track the dependencies across system events in a cyber incident, therefore, assessing the scope of damage and understanding the attack route of an intrusion. Previous approaches in security datasets have been proposed for research and educational purposes [26][27][28].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

ProvSec: Open Cybersecurity System Provenance Analysis Benchmark Dataset with Labels

Shrestha,

Kim,

et al. 2023

Int J Netw Distrib Comput

View full text Add to dashboard Cite

System provenance forensic analysis has been studied by a large body of research work. This area needs fine granularity data such as system calls along with event fields to track the dependencies of events. While prior work on security datasets has been proposed, we found a useful dataset of realistic attacks and details that are needed for high-quality provenance tracking is lacking. We created a new dataset of eleven vulnerable cases for system forensic analysis. It includes the full details of system calls including syscall parameters. Realistic attack scenarios with real software vulnerabilities and exploits are used. For each case, we created two sets of benign and adversary scenarios which are manually labeled for supervised machine-learning analysis. In addition, we present an algorithm to improve the data quality in the system provenance forensic analysis. We demonstrate the details of the dataset events and dependency analysis of our dataset cases.

show abstract