CoChat
Sign Up
PreprintCited by 2

SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data

Hossain, Md Nahid, Milajerdi, Sadegh M, Wang, Junao, Eshete, Birhanu, Gjomemo, Rigel, Sekar, R, Stoller, Scott, Venkatakrishnan, VN·2018·arXiv
DOI 10.48550/arxiv.1801.02062arXiv 1801.02062
Open this paper in CoChat — free account

Abstract

We present an approach and system for real-time reconstruction of attack scenarios on an enterprise host. To meet the scalability and real-time needs of the problem, we develop a platform-neutral, main-memory based, dependency graph abstraction of audit-log data. We then present efficient, tag-based techniques for attack detection and reconstruction, including source identification and impact analysis. We also develop methods to reveal the big picture of attacks by construction of compact, visual graphs of attack steps. Our system participated in a red team evaluation organized by DARPA and was able to successfully detect and reconstruct the details of the red team's attacks on hosts running Windows, FreeBSD and Linux.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.1801.02062

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

No references could be resolved yet.

Research works printed but not linked: 44

  1. Adam Bates, Dave Jing Tian, Kevin RB Butler, and Thomas Moyer. Trustworthy whole-system provenance for the linux ker- nel. In USENIX Security, 2015.
  2. D. E. Bell and L. J. LaPadula. Secure computer systems: Math- ematical foundations. Technical Report MTR-2547, Vol. 1, MITRE Corp., Bedford, MA, 1973.
  3. Konstantin Berlin, David Slater, and Joshua Saxe. Malicious be- havior detection using windows audit logs. In Proceedings of the 8th ACM Workshop on Artificial Intelligence and Security, 2015.
  4. Uri Braun, Simson Garfinkel, David A Holland, Kiran-Kumar Muniswamy-Reddy, and Margo I Seltzer. Issues in automatic provenance collection. In International Provenance and Annota- tion Workshop. Springer, 2006.
  5. Hervé Debar and Andreas Wespi. Aggregation and correlation of intrusion-detection alerts. In RAID. Springer, 2001.
  6. Dorothy E Denning. An intrusion-detection model. IEEE Trans- actions on software engineering, 1987.
  7. David Ediger, Robert McColl, Jason Riedy, and David A Bader. Stinger: High performance data structure for streaming graphs. In High Performance Extreme Computing (HPEC). IEEE, 2012.
  8. Petros Efstathopoulos, Maxwell Krohn, Steve VanDeBogart, Cliff Frey, David Ziegler, Eddie Kohler, David Mazières, Frans Kaashoek, and Robert Morris. Labels and Event Processes in the Asbestos Operating System. In SOSP. ACM, 2005.
  9. Henry Hanping Feng, Oleg M Kolesnikov, Prahlad Fogla, Wenke Lee, and Weibo Gong. Anomaly detection using call stack infor- mation. In S&P. IEEE, 2003.
  10. Stephanie Forrest, Steven Hofmeyr, Aniln Somayaji, Thomas Longstaff, et al. A sense of self for unix processes. In S&P. IEEE, 1996.
  11. Debin Gao, Michael K Reiter, and Dawn Song. Gray-box extrac- tion of execution graphs for anomaly detection. In CCS. ACM, 2004.
  12. Ashish Gehani and Dawood Tariq. Spade: support for provenance auditing in distributed environments. In Proceedings of the 13th International Middleware Conference. Springer, 2012.
  13. A. Goel, W. C. Feng, D. Maier, W. C. Feng, and J. Walpole. Forensix: a robust, high-performance reconstruction system. In 25th IEEE International Conference on Distributed Computing Systems Workshops, 2005.
  14. Samuel T King and Peter M Chen. Backtracking intrusions. In SOSP. ACM, 2003.
  15. Samuel T King, Zhuoqing Morley Mao, Dominic G Lucchetti, and Peter M Chen. Enriching intrusion alerts through multi-host causality. In NDSS, 2005.
  16. Calvin Ko, Manfred Ruschitzka, and Karl Levitt. Execution mon- itoring of security-critical programs in distributed systems: A specification-based approach. In S&P. IEEE, 1997.
  17. Maxwell Krohn, Alexander Yip, Micah Brodsky, Natan Cliffer, M. Frans Kaashoek, Eddie Kohler, and Robert Morris. Informa- tion Flow Control for Standard OS Abstractions. In SOSP. ACM, 2007.
  18. Christopher Kruegel, Fredrik Valeur, and Giovanni Vigna. In- trusion detection and correlation: challenges and solutions. Springer Science & Business Media, 2005.
  19. Christopher Kruegel and Giovanni Vigna. Anomaly detection of web-based attacks. In CCS. ACM, 2003.
  20. Kyu Hyung Lee, Xiangyu Zhang, and Dongyan Xu. High accu- racy attack provenance via binary-based execution partition. In NDSS, 2013.
  21. Wenke Lee, Salvatore J Stolfo, and Kui W Mok. A data min- ing framework for building intrusion detection models. In S&P. IEEE, 1999.
  22. Ninghui Li, Ziqing Mao, and Hong Chen. Usable Mandatory Integrity Protection for Operating Systems . In S&P. IEEE, 2007.
  23. Chi-Keung Luk, Robert Cohn, Robert Muth, Harish Patil, and Artur Klauser et al. Pin: building customized program analysis tools with dynamic instrumentation. In PLDI, 2005.
  24. Shiqing Ma, Xiangyu Zhang, and Dongyan Xu. ProTracer: To- wards practical provenance tracing by alternating between log- ging and tainting. In NDSS, 2016.
  25. Ziqing Mao, Ninghui Li, Hong Chen, and Xuxian Jiang. Com- bining Discretionary Policy with Mandatory Information Flow in Operating Systems. In Transactions on Information and System Security (TISSEC). ACM, 2011.
  26. Robert Campbell McColl, David Ediger, Jason Poovey, Dan Campbell, and David A Bader. A performance evaluation of open source graph databases. In Proceedings of the first workshop on Parallel programming for analytics applications. ACM, 2014.
  27. Kiran-Kumar Muniswamy-Reddy, David A Holland, Uri Braun, and Margo I Seltzer. Provenance-aware storage systems. In USENIX Annual Technical Conference, 2006.
  28. Peng Ning and Dingbang Xu. Learning attack strategies from intrusion alerts. In CCS. ACM, 2003.
  29. Steven Noel, Eric Robertson, and Sushil Jajodia. Correlating in- trusion events and building attack scenarios through attack graph distances. In ACSAC. IEEE, 2004.
  30. Devin J Pohly, Stephen McLaughlin, Patrick McDaniel, and Kevin Butler. Hi-fi: collecting high-fidelity whole-system prove- nance. In ACSAC. ACM, 2012.
  31. Xinzhou Qin and Wenke Lee. Statistical causality analysis of infosec alert data. In RAID. Springer, 2003.
  32. R Sekar, Mugdha Bendre, Dinakar Dhurjati, and Pradeep Bolli- neni. A fast automaton-based method for detecting anomalous program behaviors. In S&P. IEEE, 2001.
  33. Xiaokui Shu, Danfeng Yao, and Naren Ramakrishnan. Un- earthing stealthy program attacks buried in extremely long exe- cution paths. In CCS. ACM, 2015.
  34. Weiqing Sun, R Sekar, Zhenkai Liang, and VN Venkatakrishnan. Expanding malware defense by securing software installations. In Detection of Intrusions, Malware and Vulnerability Analysis (DIMVA). Springer, 2008.
  35. Weiqing Sun, R. Sekar, Gaurav Poothia, and Tejas Karandikar. Practical Proactive Integrity Preservation: A Basis for Malware Defense. In S&P. IEEE, 2008.
  36. Wai Kit Sze, Bhuvan Mital, and R Sekar. Towards more usable information flow policies for contemporary operating systems. In Proceedings of the 19th ACM symposium on Access control mod- els and technologies, 2014.
  37. Wai-Kit Sze and R Sekar. A portable user-level approach for system-wide integrity protection. In ACSAC. ACM, 2013.
  38. Wai Kit Sze and R Sekar. Provenance-based integrity protection for windows. In ACSAC. ACM, 2015.
  39. Prem Uppuluri and R Sekar. Experiences with specification- based intrusion detection. In RAID. Springer, 2001.
  40. David Wagner and Drew Dean. Intrusion detection via static anal- ysis. In S&P. IEEE, 2001.
  41. Wei Wang and Thomas E Daniels. A graph based approach to- ward network forensics analysis. Transactions on Information and System Security (TISSEC), 2008.
  42. Christina Warrender, Stephanie Forrest, and Barak Pearlmutter. Detecting intrusions using system calls: Alternative data models. In S&P. IEEE, 1999.
  43. Wei Xu, Sandeep Bhatkar, and R Sekar. Taint-enhanced policy enforcement: A practical approach to defeat a wide range of at- tacks. In USENIX Security, 2006.
  44. Nickolai Zeldovich, Silas Boyd-Wickizer, Eddie Kohler, and David Mazières. Making Information Flow Explicit in HiStar. In OSDI. USENIX, 2006.

Cited by

Sorted by citations

Authors
Hossain, M. N., Milajerdi, S. M., Wang, J., Eshete, B., Gjomemo, R., Sekar, R., Stoller, S., & Venkatakrishnan, V.
Venue
arXiv
Publisher
arXiv
Published
2018
DOI
10.48550/arxiv.1801.02062
arXiv
1801.02062
References
0
Type
Preprint
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review