Towards provenance-based intrusion detection
Jun 6, 2019
Abstract
Provenance is the representation of a system execution as a directed acyclic graph. Whole-system provenance graph, representing the execution of an entire system from initialization to shut down, can be comprised of millions of graph elements. In this talk, I will present my work on the development of a provenance-based intrusion detection system. I will discuss the development of the stack from the kernel-level capture mechanism to the algorithm used to perform intrusion detection. Finally, I will discuss planned future work and areas of potential collaborations.
Location
HP Labs, Bristol
Authors
Associate Professor
I am an Associate Professor at the University of Oxford, where I am a member of the Security and Systems research themes.
Previously, I was an Assistant Professor in the Department of Computer Science at the University of British Columbia and remain affiliated with the UBC Security & Privacy Group and the Systopia Lab.
My research asks a fundamental question: How do we make complex systems observable enough to secure, understand, and safely modify them? I explore this question through work on system auditing and accountability, intrusion detection, and mechanisms for safely extending and optimizing complex systems.