308 citations · 529 across the 11 of their papers we have counts for
11 papers
Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance
Zijun Cheng, Qiujian Lv, Jinyuan Liang +4
Provenance graphs are structured audit logs that describe the history of a system's execution. Recent studies have explored a variety of techniques to analyze provenance graphs for…
Unleashing Unprivileged eBPF Potential with Dynamic Sandboxing
Soo Yee Lim, Xueyuan Han, Thomas Pasquier
For safety reasons, unprivileged users today have only limited ways to customize the kernel through the extended Berkeley Packet Filter (eBPF). This is unfortunate, especially sinc…
Secure Namespaced Kernel Audit for Containers
Soo Yee Lim, Bogdan Stelea, Xueyuan Han +1
Despite the wide usage of container-based cloud computing, container auditing for security analysis relies mostly on built-in host audit systems, which often lack the ability to ca…
SIGL: Securing Software Installations Through Deep Graph Learning
Xueyuan Han, Xiao Yu, Thomas Pasquier +5
Many users implicitly assume that software can only be exploited after it is installed. However, recent supply-chain attacks demonstrate that application integrity must be ensured…
Xanthus: Push-button Orchestration of Host Provenance Data Collection
Xueyuan Han, James Mickens, Ashish Gehani +2
Host-based anomaly detectors generate alarms by inspecting audit logs for suspicious behavior. Unfortunately, evaluating these anomaly detectors is hard. There are few high-quality…
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats
Xueyuan Han, Thomas Pasquier, Adam Bates +2
Advanced Persistent Threats (APTs) are difficult to detect due to their "low-and-slow" attack patterns and frequent use of zero-day exploits. We present UNICORN, an anomaly-based A…
Runtime Analysis of Whole-System Provenance
Thomas Pasquier, Xueyuan Han, Thomas Moyer +5
Identifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of inf…
Provenance-based Intrusion Detection: Opportunities and Challenges
Xueyuan Han, Thomas Pasquier, Margo Seltzer
Intrusion detection is an arms race; attackers evade intrusion detection systems by developing new attack vectors to sidestep known defense mechanisms. Provenance provides a detail…
Sharing and Preserving Computational Analyses for Posterity with encapsulator
Thomas Pasquier, Matthew K. Lau, Xueyuan Han +6
Open data and open-source software may be part of the solution to science's "reproducibility crisis", but they are insufficient to guarantee reproducibility. Requiring minimal end-…
FRAPpuccino: Fault-detection through Runtime Analysis of Provenance
Xueyuan Han, Thomas Pasquier, Tanvi Ranjan +2
We present FRAPpuccino (or FRAP), a provenance-based fault detection mechanism for Platform as a Service (PaaS) users, who run many instances of an application on a large cluster o…
Practical Whole-System Provenance Capture
Thomas Pasquier, Xueyuan Han, Mark Goldstein +4
Data provenance describes how data came to be in its present form. It includes data sources and the transformations that have been applied to them. Data provenance has many uses, f…