In recent years, the Advanced Persistent Threat (APT), which involves complex and
malicious actions over a long period, has become one of the biggest threats against the …

Building provenance graph that considers causal relationships among software behaviors
can better provide contextual information of cyber attacks, especially for advanced attacks …

Abstract Advance Persistent Threats (APTs), adopted by most delicate attackers, are
becoming increasing common and pose great threat to various enterprises and institutions …

We present ProvG-Searcher, a novel approach for detecting known APT behaviors within
system security logs. Our approach leverages provenance graphs, a comprehensive graph …

With the development of information technology, the border of the cyberspace gets much
broader and thus also exposes increasingly more vulnerabilities to attackers. Traditional …

Host-based threats such as Program Attack, Malware Implantation, and Advanced Persistent
Threats (APT), are commonly adopted by modern attackers. Recent studies propose …

Advanced Persistent Threats (APT) attacks have plagued modern enterprises, causing
significant financial losses. To counter these attacks, researchers propose techniques that …

System-level provenance offers great promise for improving security by facilitating the
detection of attacks. Unsupervised anomaly detection techniques are necessary to defend …

Reliable methods for host-layer intrusion detection remained an open problem within
computer security. Recent research has recast intrusion detection as a provenance graph …

Recently, provenance-based Intrusion Detection Systems (IDSes) have gained popularity for
their potential in detecting sophisticated Advanced Persistent Threat (APT) attacks. These …