Trustworthy Whole-System Provenance for the Linux Kernel
By Adam Bates, Dave (Jing) Tian, Kevin R. B. Butler, Thomas Moyer. USENIX Security Symposium, 2015
297 citations recorded by the source corpus.
View Paper: https://www.semanticscholar.org/paper/114f664a25c411b708c0f0058c3f455b5a1f3e9b
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
- Wajih Ul Hassan
- Xueyuan Han
- Adam Bates
- Sadegh M. Milajerdi
- Qi Wang
- Thomas Pasquier
- Daniel Marino
- Birhanu Eshete
Citations in the corpus
- HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows (2018, background): “Although the default auditing system incurs nontrivial overheads, recent research has shown that overheads can be made small [12], [46].”
- Tactical Provenance Analysis for Endpoint Detection and Response Systems (2020, methodology): “In recent years, significant advancements have been made that improve the fidelity [20], [21], [22], [23], [24], [25], [26], [27], [28] and efficiency [29], [30], [31], [32], [33], [34], [35], [36], [37] of causal analysis, and recent results indicate that causal analysis can even be leveraged to im”
- NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage (2019, methodology): “TABLE III: Comparison of dependency graphs generated by NODOZE against prior tools [26], [41].”
- UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats (2020, methodology): “OS-level provenance systems such as Hi-Fi [104], LPM [16], and CamFlow [100] provide strong security and completeness guarantees with respect to information flow capture.”
- You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis (2020, methodology): “Provenance-based Solutions A large body of work has been proposed to leverage provenance for multiple areas such as forensic analysis [30], [70], [71], [74], [89], [55], [29], [57], network debugging and troubleshooting [38], [37], alert triage [56], intrusion detection and access control [28], [86]”
- SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data (2018, background): “Provenance tracking and Forensics Several logging and provenance tracking systems have been built to monitor the activities of a system [21, 41, 23, 22, 13, 45, 9] and build provenance graphs.”