Backtracking intrusions

By Samuel T. King, Peter M. Chen. Symposium on Operating Systems Principles, 2003

689 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/1e4e963670719ee1cb6bff8f87a33edc39c69e21

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Log2vec: A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise (2019, background): “Certainly, they can also utilize advanced methods regarding forensics [17, 22, 55].”
Zyzzyva (2007, background): “, snapshots in a file system [34, 16]) so that data can be recovered from older versions if a faulty client destroys data [14].”
Provenance-Aware Storage Systems (2006, neutral): “Systems such as the Lineage File System [13] and Backtracker [11] log every read and write and later build the lineage from the log.”
SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data (2018, methodology): “relevant nodes and sets SLEUTH apart from other scenario reconstruction approaches such as [25, 31].”
NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage (2019, methodology): “Provenance-based tools [41], [26] process individual events between system objects (e.”
NVisionIP: netflow visualizations of system state for security situational awareness (2004, methodology): “In [11], the authors present a tool to help automate the task of analyzing intrusions to a single host.”
You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis (2020, background): “[12] and our causal path selection algorithm in §V-C.”
Panorama: capturing system-wide information flow for malware detection and analysis (2007, background): “For example, some systems track the flow of information between operating system processes to perform intrusion analysis [23], intrusion recovery [17], and malware removal [21].”
POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting (2019, methodology): “Theideatoconstructaprove-nance graph from kernel audit logs was introduced by King et al. [33, 35].”
Pioneer: verifying code integrity and enforcing untampered code execution on legacy systems (2005, methodology): “Backward security can be achieved if we combine our approach with schemes that backtrack intrusions through analyzing system event logs [17].”
Towards an understanding of anti-virtualization and anti-debugging behavior in modern malware (2008, background): “Virtual machines can be an effective environment in which to study activities and techniques of attackers [4] [17] [20].”
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats (2020, methodology): “BackTracker [69] analyzes intrusions using a provenance graph to identify the entry point of the intrusion, while PriorTracker [79] optimizes this process and enables a forward tracking capability for timely attack causality analysis.”
Behavioral detection of malware on mobile handsets (2008, background): “An alternative to the signature-based approach, behavioral detection [13], has emerged as a promising way of preventing the intrusion of spyware, viruses and worms.”
CloudAV: N-Version Antivirus in the Network Cloud (2008, background): “While some forensics tracking systems [14, 8] provide fine-grained details tracing back to the exact vulnerable processes and system objects involved in an infection, they are often accompanied by high storage requirements and performance degradation.”
HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows (2018, background): “A large number of research efforts have been focused on generation and use of system-call level logs in forensic analysis, investigation and recovery [12], [18]– [20], [27], [28], [34], [36]–[39], [46], [53].”
Making Byzantine Fault Tolerant Systems Tolerate Byzantine Faults (2009, neutral): “While different systems don’t completely agree on what deﬁnes the common case [16], on one point they are unanimous: the common case includes only gracious executions , deﬁned as follows: Deﬁnition 2 (Gracious execution) .”
Automated Classification and Analysis of Internet Malware (2007, methodology): “The system events are captured and exported to an external server using the Backtracker system [12].”
Tactical Provenance Analysis for Endpoint Detection and Response Systems (2020, background): “Data provenance is a promising approach to investigate cyber attacks [46].”