Efficient Large-Scale Data Provenance Tracking and Analyzing: Intrusion Detection
Jan 28, 2021
Abstract
Provenance is the representation of a system execution as a directed acyclic graph. Those graphs, representing the execution of an entire system from initialization to shut down, can be comprised of millions of graph elements. After a general introduction to the field of data provenance, it will present my recent work on the development of a provenance-based intrusion detection system. The system spans the entire software stack from the kernel-level capture mechanism to the algorithm used to perform intrusion detection. This talk is based on papers published at ACM CCS, NDSS and USENIX Security. I will be available after the talk for further technical discussions.
Location
Two Sigma (Virtually)
Authors
Associate Professor
I am an Associate Professor at the University of Oxford, where I am a member of the Security and Systems research themes.
Previously, I was an Assistant Professor in the Department of Computer Science at the University of British Columbia and remain affiliated with the UBC Security & Privacy Group and the Systopia Lab.
My research asks a fundamental question: How do we make complex systems observable enough to secure, understand, and safely modify them? I explore this question through work on system auditing and accountability, intrusion detection, and mechanisms for safely extending and optimizing complex systems.