Provenance-based Intrusion Detection: Opportunities and Challenges

2018/06/04 by Han, Xueyuan, Pasquier, Thomas, Seltzer, Margo · 3 citations
#Cryptography and Security (cs.CR) #FOS: Computer and information sciences #FOS: Electrical engineering #Systems and Control (eess.SY) #electronic engineering #information engineering

paper · doi:10.48550/arxiv.1806.00934

Abstract

Intrusion detection is an arms race; attackers evade intrusion detection systems by developing new attack vectors to sidestep known defense mechanisms. Provenance provides a detailed, structured history of the interactions of digital objects within a system. It is ideal for intrusion detection, because it offers a holistic, attack-vector-agnostic view of system execution. As such, provenance graph analysis fundamentally strengthens detection robustness. We discuss the opportunities and challenges associated with provenance-based intrusion detection and provide insights based on our experience building such systems.

Cited by

• Ranking-Enhanced Anomaly Detection Using Active Learning-Assisted Attention Adversarial Dual AutoEncoders
• Adversarial Augmentation and Active Sampling for Robust Cyber Anomaly Detection
• Attackers Strike Back? Not Anymore -- An Ensemble of RL Defenders Awakens for APT Detection

Related

• Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance
• MirGuard: Towards a Robust Provenance-based Intrusion Detection System Against Graph Manipulation Attacks
• Runtime Analysis of Whole-System Provenance
• SecTracer: A Framework for Uncovering the Root Causes of Network Intrusions via Security Provenance
• OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Prompting