SPADE: Support for Provenance Auditing in Distributed Environments

By Ashish Gehani, Dawood Tariq. International Middleware Conference, 2012

311 citations recorded by the source corpus.

SPADE is an open source software infrastructure for data provenance collection and management. The underlying data model used throughout the system is graph-based, consisting of vertices and directed edges that are modeled after the node and relationship types described in the Open Provenance Model. The system has been designed to decouple the collection, storage, and querying of provenance metadata. At its core is a novel provenance kernel that mediates between the producers and consumers of provenance information, and handles the persistent storage of records. It operates as a service, peering with remote instances to enable distributed provenance queries. The provenance kernel on each host handles the buffering, filtering, and multiplexing of incoming metadata from multiple sources, including the operating system, applications, and manual curation. Provenance elements can be located locally with queries that use wildcard, fuzzy, proximity, range, and Boolean operators. Ancestor and descendant queries are transparently propagated across hosts until a terminating expression is satisfied, while distributed path queries are accelerated with provenance sketches.

Subfields: Computer Networks and Communications, Information Systems, Information Systems and Management

View Paper: https://www.semanticscholar.org/paper/64deeabad27bb3562f4837fc3175928cd2deb9fc

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Information Systems and Management

Citations in the corpus

HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows (2018, background): “A large number of research efforts have been focused on generation and use of system-call level logs in forensic analysis, investigation and recovery [12], [18]– [20], [27], [28], [34], [36]–[39], [46], [53].”
SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data (2018, background): “Provenance tracking and Forensics Several logging and provenance tracking systems have been built to monitor the activities of a system [21, 41, 23, 22, 13, 45, 9] and build provenance graphs.”
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats (2020, methodology): “During deployment, graph sketches are created through the same steps ( 1 , 2 and 3 ) and then compared against the model in 4 . systems, such as LPM [16] and Spade [44], the latter of which interoperates with commodity audit systems such as Linux Audit and Windows ETW.”
Trustworthy Whole-System Provenance for the Linux Kernel (2015, methodology): “Our instrumentation of ImageMagick demonstrates that LPM supports layered provenance at no additional cost over other provenance-aware systems [29, 43], and does so in a manner that provides assurance of the integrity of the provenance log.”
A survey on provenance: What for? What form? What from? (2017, background): “It adds provenance instrumentation at compile time [79,175].”