308 citations · 529 across the 11 of their papers we have counts for
8 papers · 1 filter
Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance
Zijun Cheng, Qiujian Lv, Jinyuan Liang +4
Provenance graphs are structured audit logs that describe the history of a system's execution. Recent studies have explored a variety of techniques to analyze provenance graphs for…
Secure Namespaced Kernel Audit for Containers
Soo Yee Lim, Bogdan Stelea, Xueyuan Han +1
Despite the wide usage of container-based cloud computing, container auditing for security analysis relies mostly on built-in host audit systems, which often lack the ability to ca…
SIGL: Securing Software Installations Through Deep Graph Learning
Xueyuan Han, Xiao Yu, Thomas Pasquier +5
Many users implicitly assume that software can only be exploited after it is installed. However, recent supply-chain attacks demonstrate that application integrity must be ensured…
Xanthus: Push-button Orchestration of Host Provenance Data Collection
Xueyuan Han, James Mickens, Ashish Gehani +2
Host-based anomaly detectors generate alarms by inspecting audit logs for suspicious behavior. Unfortunately, evaluating these anomaly detectors is hard. There are few high-quality…
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats
Xueyuan Han, Thomas Pasquier, Adam Bates +2
Advanced Persistent Threats (APTs) are difficult to detect due to their "low-and-slow" attack patterns and frequent use of zero-day exploits. We present UNICORN, an anomaly-based A…
Runtime Analysis of Whole-System Provenance
Thomas Pasquier, Xueyuan Han, Thomas Moyer +5
Identifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of inf…
Provenance-based Intrusion Detection: Opportunities and Challenges
Xueyuan Han, Thomas Pasquier, Margo Seltzer
Intrusion detection is an arms race; attackers evade intrusion detection systems by developing new attack vectors to sidestep known defense mechanisms. Provenance provides a detail…
Practical Whole-System Provenance Capture
Thomas Pasquier, Xueyuan Han, Mark Goldstein +4
Data provenance describes how data came to be in its present form. It includes data sources and the transformations that have been applied to them. Data provenance has many uses, f…