Provenance graph generation for intrusion detection - Chew, Perlyn Jie Ying (Nanyang Technological University, 2023)
In this digital age, cyberattacks are becoming more complex, and are accompanied by increasingly severe consequences. Traditional intrusion detection systems are struggling to identify sophisticated threats such as zero-day attacks or Advanced Persistent Threats (APTs) efficiently and effectively. To address this challenge, modern approaches are required. Provenance graphs emerge as a promising data source for modern intrusion detection by capturing comprehensive information on both malicious and benign system activities. Provenance describes the history or lineage of an object, and captures information on how digital objects arrive at their existing state. These graphs present complex dependencies and relationships in the form of a directed acyclic graph that has potential for analysis using machine learning methods. However, there are few end-to-end pipelines that automatically generate and transform provenance data into graph representations suitable for machine learning. The Flurry framework is a contemporary approach, built upon CamFlow, a provenance capture system, to improve the reproducibility and ease of generating provenance graphs for machine learning.