We present PROVNINJA, a framework designed to generate adversarial attacks that aim to
elude provenance-based Machine Learning (ML) security detectors. PROVNINJA is …

Provenance graphs are structured audit logs that describe the history of a system's
execution. Recent studies have explored a variety of techniques to analyze provenance …

Recently, provenance-based Intrusion Detection Systems (IDSes) have gained popularity for
their potential in detecting sophisticated Advanced Persistent Threat (APT) attacks. These …

Intrusion and prevention technologies perform reliably in harsh conditions by fortifying many
of the world's highest security sites with few defects in high performance. This paper aims to …

The rise of advanced persistent threats (APTs) has marked a significant cybersecurity
challenge, characterized by sophisticated orchestration, stealthy execution, extended …

The black-box nature of complex Neural Network (NN)-based models has hindered their
widespread adoption in security domains due to the lack of logical explanations and …

In modern enterprise security, endpoint detection products fire an alert when process activity
matches known attack behavior patterns. Human analysts then perform Root Cause …

As cyber-attacks become increasingly sophisticated and stealthy, it becomes more
imperative and challenging to detect intrusion from normal behaviors. Through fine-grained …

Securing endpoints is challenging due to the evolving nature of threats and attacks. With
endpoint logging systems becoming mature, provenance-graph representations enable the …

In Advanced Persistent Threat (APT) attacks, achieving stealthy persistence within target
systems is often crucial for an attacker's success. This persistence allows adversaries to …