Where the Numbers Come From: Auditing Evaluation in Provenance-Based Intrusion Detection

Jihwan Moon, Gunhee Kim, Myeongjang Pyeon

Reproducing a provenance-based intrusion detector's score does not establish what that score says about its emitted alarms or the information its encoder uses. We audit nine releas…