I-Corps: Translation potential of using provenance-based threat detection for improving cybersecurity

这个i-Corps项目的更广泛影响是开发了保护计算机工作站和服务器免受攻击的技术。一种基于历史记录的方法，可将数据从原始来源追溯到当前位置(称为数据来源分析)。保护终端计算机的安全是企业安全的重要组成部分。当前的解决方案采用通过将端点活动与描述常见攻击行为的一组检测规则进行比较来检测攻击的策略。然而，这是一种容易出错的做法，会导致大量错误警报，同时无法检测到复杂的攻击。此外，在缺乏必要安全资源和人员的中小型企业(SMB)中，调查这些虚假警报的维护要求构成了一个艰巨的挑战。这一障碍在存储敏感用户数据的中小型企业中更加明显，在这些企业中，安全漏洞可能会产生深远而持久的财务和社会后果。这项技术可以用来建立数据来源分析，作为检测对终端的攻击的更精确和实用的手段。此外，该解决方案还可以通过挫败可能导致客户数据泄露的攻击，为美国公司节省数百万美元。这个i-Corps项目利用经验学习和对行业生态系统的第一手调查来评估该技术的翻译潜力。该解决方案是基于对数据来源分析的开发，以确保网络安全。数据起源技术递增地将各个端点事件(例如，进程执行和文件访问)解析成描述系统执行历史的因果依赖图。终端活动的图形表示突出显示了对象之间的关系，从而更容易识别可疑活动。这项研究的一个关键发现是克服了用于分析数据起源图的机器学习模型中固有的体系结构限制的方法。利用这种方法，训练了一个模型，该模型通过将程序的典型行为与其完整的历史背景相关联来全面捕获它们。通过将可疑程序与模型对每个程序的行为的预期进行比较来检测攻击，这是由程序的来源告知的。与当前的终端安全解决方案相比，这种方法显著减少了错误警报的发生，同时还消除了频繁的系统调整(如添加和删除检测规则)的需要。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The broader impact of this I-Corps project is the development of technology for securing computer workstations and servers from attack. The approach based on the historical record that traces data from its original source to its current location (called data provenance analysis). Securing endpoint computers is a vital component of enterprise security. Current solutions adopt a strategy for detecting attacks by comparing endpoint activity to a set of detection rules that describe common attack behaviors. However, this is an error prone practice, leading to large volumes of false alerts while failing to detect sophisticated attacks. In addition, the maintenance requirements of investigating these false alerts pose a formidable challenge within smaller to medium-sized businesses (SMBs), which lack the necessary security resources and personnel. This impediment is even more visible within SMBs housing sensitive user data, where a security breach can have profound and enduring financial and societal consequences. This technology may be used to establish data provenance analysis as a more precise and practical means of detecting attacks on endpoints. In addition, this solution may save U.S. companies millions of dollars by thwarting attacks that could have otherwise resulted in the compromise of customer data.This I-Corps project utilizes experiential learning coupled with a first-hand investigation of the industry ecosystem to assess the translation potential of the technology. The solution is based on the development of analysis of data provenance to ensure cyber security. Data provenance techniques incrementally parse individual endpoint events (e.g., process executions and file accesses) into a causal dependency graph that describes the history of system execution. The graphical representation of endpoint activity highlights the relationships between objects, making it easier to identify suspicious activities. A key finding of this research is a method of overcoming the inherent architectural limitations in the machine learning models used to analyze data provenance graphs. Leveraging this method, a model was trained that comprehensively captures the typical behavior of programs by associating them with their full historical context. Attacks are detected by comparing suspicious programs to the models’ expectations of each program’s behavior, which is informed by the programs’ provenance. This approach significantly reduces the occurrence of false alerts when compared to current endpoint security solutions, while also eliminating the need for frequent system tuning such as the adding and removing of detection rules.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.