Intrusion Detection

[NEW!] KAIROS: Practical Intrusion Detection and Investigation using Whole-system Provenance
Provenance graphs are structured audit logs that describe the history of a system’s execution. Recent studies have explored a variety …
Zijun Cheng, Qiujian Lv, Yan Wang, Degang Sun, Thomas Pasquier, Xueyuan Michael Han-Vanbastelaer
PDF Cite Code
[NEW!] KAIROS: Practical Intrusion Detection and Investigation using Whole-system Provenance
Sometimes, You Aren’t What You Do: Mimicry Attacks against Provenance Graph Host Intrusion Detection Systems
Reliable methods for host-layer intrusion detection remained an open problem within computer security. Recent research has recast …
Akul Goyal, Xueyuan Michael Han-Vanbastelaer, Gang Wang, Adam Bates
PDF Cite DOI Code
Sometimes, You Aren’t What You Do: Mimicry Attacks against Provenance Graph Host Intrusion Detection Systems
Secure Namespaced Kernel Audit for Containers

Despite the wide usage of container-based cloud computing, container auditing for security analysis relies mostly on built-in host …
Soo Yee Lim, Bogdan Stelea, Xueyuan Michael Han-Vanbastelaer, Thomas Pasquier
PDF Cite DOI Code
Secure Namespaced Kernel Audit for Containers
Xanthus: Push-button Orchestration of Host Provenance Data Collection
Host-based anomaly detectors generate alarms by inspecting audit logs for suspicious behavior. Unfortunately, evaluating these …
Xueyuan Michael Han-Vanbastelaer, James Mickens, Ashish Gehani, Margo Seltzer, Thomas Pasquier
PDF Cite DOI Code
Xanthus: Push-button Orchestration of Host Provenance Data Collection
Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats
Advanced Persistent Threats (APTs) are difficult to detect due to their “low-and-slow” attack patterns and frequent use of …
Xueyuan Michael Han-Vanbastelaer, Thomas Pasquier, Adam Bates, James Mickens, Margo Seltzer
PDF Cite DOI Code
Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats
Runtime Analysis of Whole-system Provenance
Identifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance …
Thomas Pasquier, Xueyuan Michael Han-Vanbastelaer, Thomas Moyer, Adam Bates, Olivier Hermant, David Eyers, Jean Bacon, Margo Seltzer
PDF Cite DOI Code
Runtime Analysis of Whole-system Provenance
Provenance-based Intrusion Detection: Opportunities and Challenges
Intrusion detection is an arms race; attackers evade intrusion detection systems by developing new attack vectors to sidestep known …
Xueyuan Michael Han-Vanbastelaer, Thomas Pasquier, Margo Seltzer
PDF Cite