activity
20092023
most citedUNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

308 citations · 818 across the 33 of their papers we have counts for

collaborators
Showing 2020Show all

6 papers · 1 filter

cs.CR2020★ 18 cited

SIGL: Securing Software Installations Through Deep Graph Learning

Xueyuan Han, Xiao Yu, Thomas Pasquier +5

Many users implicitly assume that software can only be exploited after it is installed. However, recent supply-chain attacks demonstrate that application integrity must be ensured…

cs.CY2020★ 4 cited

The EuroSys 2020 Online Conference: Experience and lessons learned

Angelos Bilas, Dejan Kostic, Kostas Magoutis +4

The 15th European Conference on Computer Systems (EuroSys'20) was organized as a virtual (online) conference on April 27-30, 2020. The main EuroSys'20 track took place April 28-30,…

cs.LG2020★ 41 cited

Generalized and Scalable Optimal Sparse Decision Trees

Jimmy Lin, Chudi Zhong, Diane Hu +2

Decision tree optimization is notoriously difficult from a computational perspective but essential for the field of interpretable machine learning. Despite efforts over the past 40…

cs.NI2020

Parking Packet Payload with P4

Swati Goswami, Nodir Kodirov, Craig Mustard +2

Network Function (NF) deployments suffer from poor link goodput, because popular NFs such as firewalls process only packet headers while receiving and transmitting complete packets…

cs.CR2020★ 4 cited

Xanthus: Push-button Orchestration of Host Provenance Data Collection

Xueyuan Han, James Mickens, Ashish Gehani +2

Host-based anomaly detectors generate alarms by inspecting audit logs for suspicious behavior. Unfortunately, evaluating these anomaly detectors is hard. There are few high-quality…

cs.CR2020★ 308 cited

UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Xueyuan Han, Thomas Pasquier, Adam Bates +2

Advanced Persistent Threats (APTs) are difficult to detect due to their "low-and-slow" attack patterns and frequent use of zero-day exploits. We present UNICORN, an anomaly-based A…