Provenance-based Intrusion Detection
Jan 15, 2020
Abstract
Whole-system provenance is the record of flows of information between kernel objects (e.g., files, task, sockets etc.). This information is represented as a directed acyclic graph that can be analysed to extract information about the execution of the system. Building on the DARPA transparent computing programme a number of research groups have explored means to develop provenance-based intrusion detection systems. In this talk, we will discuss how provenance can be captured and analysed to achieve such an objective.
Location
Newcastle University
Authors
Associate Professor
I am an Associate Professor at the University of Oxford, where I am a member of the Security and Systems research themes.
Previously, I was an Assistant Professor in the Department of Computer Science at the University of British Columbia and remain affiliated with the UBC Security & Privacy Group and the Systopia Lab.
My research asks a fundamental question: How do we make complex systems observable enough to secure, understand, and safely modify them? I explore this question through work on system auditing and accountability, intrusion detection, and mechanisms for safely extending and optimizing complex systems.