Towards a provenance-based intrusion detection system


Provenance is the representation of a system execution as a directed acyclic graph. Whole-system provenance graph, representing the execution of an entire system from initialisation to shut down, can be comprised of millions of graph elements. In this talk, I will present my work on the development of a provenance-based intrusion detection system. I will discuss the development of the stack from the kernel-level capture mechanism to the algorithm used to perform intrusion detection. Finally, I will discuss planned future work and areas of potential collaborations.

Dec 5, 2018 12:30 PM
Department of Computer Science Seminar, University of Bristol
University of Bristol
Thomas Pasquier
Thomas Pasquier
Lecturer (Assistant Professor) in Computer Science

My research interests include distributed robotics, mobile computing and programmable matter.