Advanced persistent threats pose a significant challenge for blue teams as they apply
various attacks over prolonged periods, impeding event correlation and their detection. In …

Attack graph-based methods are a promising approach towards discovering attacks and
various techniques have been proposed recently. A key limitation, however, is that …

As malware detection algorithms and methods become more sophisticated, malware
authors adopt equally sophisticated evasion mechanisms to defeat them. Anecdotal …

In recent years, the Advanced Persistent Threat (APT), which involves complex and
malicious actions over a long period, has become one of the biggest threats against the …

Causality analysis generates a dependency graph from system audit logs, which has
emerged as an important solution for attack investigation. In the dependency graph, nodes …

Provenance-Based Endpoint Detection and Response (P-EDR) systems are deemed crucial
for future Advanced Persistent Threats (APT) defenses. Despite the fact that numerous new …

We present TRACE, a comprehensive provenance tracking system for scalable, real-time,
enterprise-wide APT detection. TRACE uses static analysis to identify program unit …

The increasingly frequent network intrusions have brought serious impacts to the production
and life, thus malicious network traffic detection has received more and more attention in …

Building provenance graph that considers causal relationships among software behaviors
can better provide contextual information of cyber attacks, especially for advanced attacks …

Audit systems maintain detailed logs of security-related events on enterprise machines to
forensically analyze potential incidents. In principle, these logs should be safely stored in a …