The Case for Learned Provenance Graph Storage Systems
The Case for Learned Provenance Graph Storage Systems
复制标题
DOI：
--
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
Hailun Ding;Juan Zhai;Dong Deng;Shiqing Ma
中科院分区：
文献类型：
--
作者：
Hailun Ding;Juan Zhai;Dong Deng;Shiqing Ma
网络攻击变得越来越频繁和复杂，调查它们变得更具挑战性。证据图是支持取证分析的主要数据源。由于系统复杂性和攻击持续时间长，起源图可能非常庞大，有效地存储它们仍然是一个具有挑战性的问题。现有的作品通常使用关系或图形数据库来存储出处图。这些解决方案存在存储开销高和查询效率低的问题。最近，研究人员在存储系统设计中利用了深度神经网络（DNN），并取得了可喜的成果。我们观察到，DNN可以嵌入给定的输入作为上下文感知的数值向量表示，这是紧凑的，支持并行查询操作。在本文中，我们建议学习DNN作为起源图的存储系统，以实现存储和查询效率。我们还提出了新的设计，利用领域知识，以减少出处数据冗余和建立快速查询处理与索引。我们建立了一个原型L EONARD，并在12个数据集上进行了评估。与关系数据库Quickstep和图数据库Neo4j相比，L EONARD将空间开销减少了25.90倍，并将查询执行次数提高了99.6%。
Cyberattacks are becoming more frequent and sophisticated, and investigating them becomes more challenging. Prove-nance graphs are the primary data source to support forensics analysis. Because of system complexity and long attack duration, provenance graphs can be huge, and efficiently storing them remains a challenging problem. Existing works typically use relational or graph databases to store provenance graphs. These solutions suffer from high storage overhead and low query efficiency. Recently, researchers leveraged Deep Neural Networks (DNNs) in storage system design and achieved promising results. We observe that DNNs can embed given inputs as context-aware numerical vector representations, which are compact and support parallel query operations. In this paper, we propose to learn a DNN as the storage system for provenance graphs to achieve storage and query efficiency. We also present novel designs that leverage domain knowledge to reduce provenance data redundancy and build fast-query processing with indexes. We built a prototype L EONARD and evaluated it on 12 datasets. Compared with the relational database Quickstep and the graph database Neo4j, L EONARD reduced the space overhead by up to 25.90x and boosted up to 99.6% query executions.