Xanthus: Push-button Orchestration of Host Provenance Data Collection

Xueyuan Han, James Mickens, Ashish Gehani +2

Host-based anomaly detectors generate alarms by inspecting audit logs for suspicious behavior. Unfortunately, evaluating these anomaly detectors is hard. There are few high-quality…