Towards practical whole-system provenance
Jan 8, 2018
Abstract
There is a consensus that understanding data provenance, the origin and history of digital artifacts, is important. Whole-system provenance systems are capture mechanisms aimed at recording all information flows in an operating system. Such systems have been the subject of recent attention from the research security community. However, whole-system provenance as yet to make a significant impact outside of academic circles. In this talk, I will present our work on CamFlow an open-source whole-system provenance implementation for Linux, and briefly introduce ongoing work on provenance-based intrusion detection as an application example. I will discuss the technical barriers to practical whole-system provenance we aimed to overcome, and those left to address.
Location
Edinburgh, United Kingdom
Authors
Associate Professor
I am an Associate Professor at the University of Oxford, where I am a member of the Security and Systems research themes.
Previously, I was an Assistant Professor in the Department of Computer Science at the University of British Columbia and remain affiliated with the UBC Security & Privacy Group and the Systopia Lab.
My research asks a fundamental question: How do we make complex systems observable enough to secure, understand, and safely modify them? I explore this question through work on system auditing and accountability, intrusion detection, and mechanisms for safely extending and optimizing complex systems.