Tracking and Analyzing Provenance
Dec 1, 2021
Abstract
Provenance is the representation of a system execution as a directed acyclic graph. Those graphs, representing the execution of an entire system from initialization to shut down, can be comprised of millions of graph elements. In this talk, we will discuss how we can capture provenance efficiently while providing guarantees about its completeness and accuracy. We will also look at how provenance can be used in practice, for example, to perform intrusion detection.
Location
IBM Research Almaden (Virtually)
Authors
Associate Professor
I am an Associate Professor at the University of Oxford, where I am a member of the Security and Systems research themes.
Previously, I was an Assistant Professor in the Department of Computer Science at the University of British Columbia and remain affiliated with the UBC Security & Privacy Group and the Systopia Lab.
My research asks a fundamental question: How do we make complex systems observable enough to secure, understand, and safely modify them? I explore this question through work on system auditing and accountability, intrusion detection, and mechanisms for safely extending and optimizing complex systems.