Trustworthy Whole-System Provenance for the Linux Kernel

No abstract is available for this paper.

• Publication year

  2015

• Venue

  USENIX Security Symposium

• Publication date

  2015-08-12

• Fields of study

  Computer Science, Engineering

• Identifiers

  No identifiers available.

• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Take Only What You Need: Leveraging Mandatory Access Control Policy to Reduce Provenance Storage Costs

  2015cited by this paper
• Let SDN Be Your Eyes: Secure Forensics in Data Center Networks

  2014influential reference
• The Last Mile: An Empirical Study of Timing Channels on seL4

  2014cited by this paper
• PROV-Overview. An Overview of the PROV Family of Documents

  2013influential reference
• Towards secure provenance-based access control in cloud environments

  2013cited by this paper
• Evaluation of a Hybrid Approach for Efficient Provenance Storage

  2013cited by this paper
• Hi-Fi: collecting high-fidelity whole-system provenance

  2012influential reference
• Dependency Path Patterns as the Foundation of Access Control in Provenance-aware Systems

  2012cited by this paper
• A provenance-based access control model

  2012cited by this paper
• SPADE: Support for Provenance Auditing in Distributed Environments

  2012influential reference
• A General-Purpose Provenance Library

  2012cited by this paper
• Compressing Provenance Graphs

  2011cited by this paper
• Identifying the provenance of correlated anomalies

  2011cited by this paper
• Secure network provenance

  2011influential reference
• Fine-grained tracking of Grid infections

  2010cited by this paper
• Trusted Computing and Provenance: Better Together

  2010cited by this paper
• Towards a Secure and Efficient System for End-to-End Provenance

  2010influential reference
• Efficient querying and maintenance of network provenance at internet-scale

  2010cited by this paper
• A Further Improved Online/Offline Signature Scheme

  2009cited by this paper
• The Case of the Fake Picasso: Preventing History Forgery with Secure Provenance

  2009cited by this paper
• Layering in Provenance Systems

  2009cited by this paper
• Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds

  2009cited by this paper
• An Access Control Language for a General Provenance Model

  2009cited by this paper
• Off-Line/On-Line Signatures: Theoretical Aspects and Experimental Results

  2008cited by this paper
• Provenance-Based Auditing of Private Data Use

  2008cited by this paper
• A logical specification and analysis for SELinux MLS policy

  2007cited by this paper
• Bonsai: Balanced Lineage Authentication

  2007cited by this paper
• PRIMA: policy-reduced integrity measurement architecture

  2006cited by this paper
• Issues in Automatic Provenance Collection

  2006cited by this paper
• Provenance-Aware Storage Systems

  2006influential reference
• SELinux and MLS : Putting the Pieces Together

  2006cited by this paper
• A Security Model for Provenance

  2006cited by this paper
• Design, implementation and evaluation of security in iSCSI-based network storage systems

  2006cited by this paper
• The Internet Protocol

  2005cited by this paper
• Automatic placement of authorization hooks in the linux security modules framework

  2005cited by this paper
• Design and Implementation of a TCG-based Integrity Measurement Architecture

  2004influential reference
• Consistency analysis of authorization hook placement in the Linux security modules framework

  2004cited by this paper
• Trio: A System for Integrated Management of Data, Accuracy, and Lineage

  2004cited by this paper
• Securing The X Window System With SELinux

  2003cited by this paper
• Linux security modules: general security support for the linux kernel

  2002influential reference
• Runtime verification of authorization hook placement for the linux security modules framework

  2002cited by this paper
• Linux Security Module Framework

  2002influential reference
• Chimera: a virtual data system for representing, querying, and automating data derivation

  2002cited by this paper
• Improved Online/Offline Signature Schemes

  2001cited by this paper
• Short Signatures from the Weil Pairing

  2001cited by this paper
• Building the IBM 4758 Secure Coprocessor

  2001cited by this paper
• Keying Hash Functions for Message Authentication

  1996cited by this paper
• On-line/off-line digital signatures

  1996cited by this paper
• A Trusted X Window System Server for Trusted Mach

  1990cited by this paper
• A Comparison of Commercial and Military Computer Security Policies

  1987cited by this paper
• Time, clocks, and the ordering of events in a distributed system

  1978cited by this paper
• Computer Security Technology Planning Study

  1972cited by this paper

• From Fluent to Verifiable: Claim-Level Auditability for Deep Research Agents

  2026cites this paper
• Private Links, Public Leaks: Consequences of Frictionless User Experience on the Security and Privacy Posture of SMS-Delivered URLs

  2026cites this paper
• PIDSMaker: Building and Evaluating Provenance-based Intrusion Detection Systems

  2026cites this paper
• Carbon Filter: Scalable, Efficient, and Secure Alert Triage for Endpoint Detection & Response

  2025cites this paper
• ORTHRUS: Achieving High Quality of Attribution in Provenance-based Intrusion Detection Systems

  2025cites this paper
• Few-Shot Learning-Based Cyber Incident Detection with Augmented Context Intelligence

  2025cites this paper
• SecTracer: A Framework for Uncovering the Root Causes of Network Intrusions via Security Provenance

  2025cites this paper
• Predictable and Secure System Auditing for Real-Time Systems

  2025cites this paper
• Rethinking Provenance Completeness with a Learning-Based Linux Scheduler

  2025influential citation
• Robust, Efficient, and Widely Available Greybox Fuzzing for COTS Binaries with System Call Pattern Feedback

  2025cites this paper
• Efficient Persistent Storage of Graphs in Provenance-based Intrusion Detection Systems

  2025influential citation
• SauronEyes: Disentangling Voluminous Logs to Unveil Camouflaged Attack Intentions

  2025cites this paper
• DeepProv: Behavioral Characterization and Repair of Neural Networks via Inference Provenance Graph Analysis

  2025cites this paper
• ProvAudit: Enhance High-Level Privacy Inference Through System Provenance Data

  2025cites this paper
• Entente: Cross-silo Intrusion Detection on Network Log Graphs with Federated Learning

  2025cites this paper
• TFLAG:Towards Practical APT Detection via Deviation-Aware Learning on Temporal Provenance Graph

  2025cites this paper
• ThreatsMaps: Automatic adjustment of CTI with the Running System

  2025cites this paper
• Rethinking Tamper-Evident Logging: A High-Performance, Co-Designed Auditing System

  2025cites this paper
• DPUaudit: DPU-assisted Pull-based Architecture for Near-Zero Cost System Auditing

  2025cites this paper
• Unified Lineage System: Tracking Data Provenance at Scale

  2025cites this paper
• TaintAttack: rapid attack investigation based on information flow tracking

  2025cites this paper
• Actminer: Applying causality tracking and increment aligning for graph-based threat hunting

  2025cites this paper
• TeRed: Normal Behavior-Based Efficient Provenance Graph Reduction for Large-Scale Attack Forensics

  2025cites this paper
• Knowledge Transfer from LLMs to Provenance Analysis: A Semantic-Augmented Method for APT Detection

  2025cites this paper
• NAHID: Node-Level Host Intrusion Detection Based on Provenance Graph

  2025cites this paper
• Sometimes Simpler is Better: A Comprehensive Analysis of State-of-the-Art Provenance-Based Intrusion Detection Systems

  2025cites this paper
• TracE2E: Easily Deployable Middleware for Decentralized Data Traceability

  2025cites this paper
• FaaSTracker: Efficient Cross-Layer Provenance Tracking of Serverless Applications With Multi-Source Correlation

  2025cites this paper
• MirGuard: Towards a Robust Provenance-based Intrusion Detection System Against Graph Manipulation Attacks

  2025cites this paper
• ProvX: Generating Counterfactual-Driven Attack Explanations for Provenance-Based Detection

  2025cites this paper
• Brewing Vodka: Distilling Pure Knowledge for Lightweight Threat Detection in Audit Logs

  2025cites this paper
• STGAN: Detecting Host Threats via Fusion of Spatial-Temporal Features in Host Provenance Graphs

  2025cites this paper
• Ancora: Accurate Intrusion Recovery for Web Applications

  2025cites this paper
• Towards Generating a Robust, Scalable and Dynamic Provenance Graph for Attack Investigation over Distributed Microservice Architecture

  2025cites this paper
• eAudit: A Fast, Scalable and Deployable Audit Data Collection System*

  2024cites this paper
• CICAPT-IIOT: A provenance-based APT attack dataset for IIoT environment

  2024cites this paper
• Winemaking: Extracting Essential Insights for Efficient Threat Detection in Audit Logs

  2024cites this paper
• Colibri: Efficient Collection of Fine-Grained Resource Metrics Necessary for Mobile Edge Computing

  2024cites this paper
• MultiKG: Multi-Source Threat Intelligence Aggregation for High-Quality Knowledge Graph Representation of Attack Techniques

  2024cites this paper
• A benchmark suite and performance analysis of user-space provenance collectors

  2024cites this paper
• CRUcialG: Reconstruct Integrated Attack Scenario Graphs by Cyber Threat Intelligence Reports

  2024cites this paper
• Obfuscating Provenance-Based Forensic Investigations with Mapping System Meta-Behavior

  2024cites this paper
• Dehydrator: Enhancing Provenance Graph Storage via Hierarchical Encoding and Sequence Generation

  2024cites this paper
• PARIS: A Practical, Adaptive Trace-Fetching and Real-Time Malicious Behavior Detection System

  2024cites this paper
• The Last Mile of Attack Investigation: Audit Log Analysis Toward Software Vulnerability Location

  2024cites this paper
• Flash: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning

  2024cites this paper
• RAPID: Robust APT Detection and Investigation Using Context-Aware Deep Learning

  2024cites this paper
• A Survey on Forensics and Compliance Auditing for Critical Infrastructure Protection

  2024cites this paper
• PROV5GC: Hardening 5G Core Network Security with Attack Detection and Attribution Based on Provenance Graphs

  2024cites this paper
• Detecting Malicious Websites From the Perspective of System Provenance Analysis

  2024cites this paper
• Watch Out Your Thumb Drive: Covert Data Theft From Portable Data Storage via Backscatter

  2024cites this paper
• A PT-based approach to construct efficient provenance graph for threat alert investigation

  2024cites this paper
• TEE-PA: TEE Is a Cornerstone for Remote Provenance Auditing on Edge Devices With Semi-TCB

  2024influential citation
• TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learning

  2024cites this paper
• Nip in the Bud: Forecasting and Interpreting Post- Exploitation Attacks in Real-Time Through Cyber Threat Intelligence Reports

  2024cites this paper
• Understanding and Bridging the Gap Between Unsupervised Network Representation Learning and Security Analytics

  2024cites this paper
• FA-SEAL: Forensically Analyzable Symmetric Encryption for Audit Logs

  2024cites this paper
• Data Lineage Construction Method for Multi-Chain-Based Data Assets Marketplaces

  2024cites this paper
• Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems

  2024cites this paper
• Cost-effective Attack Forensics by Recording and Correlating File System Changes

  2024influential citation
• SPARSE: Semantic Tracking and Path Analysis for Attack Investigation in Real-time

  2024cites this paper
• An Apriori Knowledge-based Negative Sampling Method for APT Detection

  2024cites this paper
• Decoding the MITRE Engenuity ATT&CK Enterprise Evaluation: An Analysis of EDR Performance in Real-World Environments

  2024cites this paper
• NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation

  2023cites this paper
• SoK: History is a Vast Early Warning System: Auditing the Provenance of System Intrusions

  2023influential citation
• ProvSec: Open Cybersecurity System Provenance Analysis Benchmark Dataset with Labels

  2023cites this paper
• ProvG-Searcher: A Graph Representation Learning Approach for Efficient Provenance Graph Search

  2023cites this paper
• System Auditing for Real-Time Systems

  2023influential citation
• DisProTrack: Distributed Provenance Tracking over Serverless Applications

  2023cites this paper
• System-level data management for endpoint advanced persistent threat detection: Issues, challenges and trends

  2023cites this paper
• DISTDET: A Cost-Effective Distributed Cyber Threat Detection System

  2023cites this paper
• Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance

  2023cites this paper
• A Cyber-Attack Behavior Detection Model Based on Log Activity Graph

  2023cites this paper
• Paradise: Real-Time, Generalized, and Distributed Provenance-Based Intrusion Detection

  2023cites this paper
• APM: An Attack Path-based Method for APT Attack Detection on Few-Shot Learning

  2023cites this paper
• PROV-IO<inline-formula><tex-math notation="LaTeX">$^+$</tex-math><alternatives><mml:math><mml:msup><mml:mrow/><mml:mo>+</mml:mo></mml:msup></mml:math><inline-graphic xlink:href="zheng-ieq1-3374555.gif"/></alternatives></inline-formula>: A Cross-Platform Provenance Framework for Scientific Data on HP

  2023cites this paper
• SysFlow: Toward a Programmable Zero Trust Framework for System Security

  2023cites this paper
• Data Provenance in Security and Privacy

  2023influential citation
• TeSec: Accurate Server-side Attack Investigation for Web Applications

  2023cites this paper
• The Case for Learned Provenance Graph Storage Systems

  2023cites this paper
• Auditing Frameworks Need Resource Isolation: A Systematic Study on the Super Producer Threat to System Auditing and Its Mitigation

  2023cites this paper
• autoMPI: Automated Multiple Perspective Attack Investigation With Semantics Aware Execution Partitioning

  2023cites this paper
• Prov2vec: Learning Provenance Graph Representation for Unsupervised APT Detection

  2023cites this paper
• A survey of provenance in scientific workflow

  2023cites this paper
• PACED: Provenance-based Automated Container Escape Detection

  2022cites this paper
• PalanTír: Optimizing Attack Provenance with Hardware-enhanced System Observability

  2022cites this paper
• FAuST: Striking a Bargain between Forensic Auditing’s Security and Throughput

  2022cites this paper
• Provenance Based Intrusion Detection via Measuring Provenance Sequence Similarity

  2022cites this paper
• Towards Strengthening the Security of Healthcare Devices using Secure Configuration Provenance

  2022cites this paper
• Time-Print: Authenticating USB Flash Drives with Novel Timing Fingerprints

  2022cites this paper
• Ellipsis: Towards Efficient System Auditing for Real-Time Systems

  2022cites this paper
• Transparent and Tamper-Proof Event Ordering in the Internet of Things Platforms

  2022cites this paper
• RAPID: Real-Time Alert Investigation with Context-aware Prioritization for Efficient Threat Discovery

  2022cites this paper
• SHADEWATCHER: Recommendation-guided Cyber Threat Analysis using System Audit Records

  2022cites this paper
• Towards Specificationless Monitoring of Provenance-Emitting Systems

  2022cites this paper
• DEPCOMM: Graph Summarization on System Audit Logs for Attack Investigation

  2022cites this paper
• ProvTalk: Towards Interpretable Multi-level Provenance Analysis in Networking Functions Virtualization (NFV)

  2022cites this paper
• ALASTOR: Reconstructing the Provenance of Serverless Intrusions

  2022cites this paper
• Provenance-based Intrusion Detection Systems: A Survey

  2022influential citation
• Enhancing the Security & Privacy of Wearable Brain-Computer Interfaces

  2022cites this paper