Next Generation Provenance-based Intrusion Detection System

点击翻译按钮获取中文摘要

Worldwide, attacks on computer systems are adversely affecting everyday life, from schools closing in Iowa, cancellation of hospital appointments in Ireland, supermarkets closure in Sweden, to fuel disruption in the US. Of particular concern is the increased number of Advanced Persistent Threat (APT) attacks. APTs are subtle targeted attacks designed by well-resourced and skilled attackers. The attackers extend their control of a system over a period of months or years before finally launching a potentially devastating attack that can, in certain cases, affect critical infrastructures. APTs remain undetected for years due to the opacity and complexity of modern computer systems. Over the last few years, provenance-based intrusion detection has been heralded as a potential solution in the academic security community. Provenance is the representation of system execution as a directed acyclic graph that captures the causal relationship between events greatly increasing system observability. Intrusion detection techniques applied to this graph data can detect attacks and investigate suspicious behaviors. However, such systems have not been widely deployed for a few fundamental reasons. First, current academic prototypes and experimental setups are not adapted to current industry standards and practices. Second, there is a global shortage of security talent making attack investigation an expensive endeavor. Provenance-based systems are unfamiliar and require complex investigation strategies, leading to a high adoption cost. Finally, academic evaluation standards have been relatively poor when compared with more conventional intrusion detection techniques casting doubt upon their real effectiveness. In the proposed research program, I will design a practical end-to-end provenance-based intrusion detection solution that meets current industry standards and practices. A core objective of this research is to design a solution that can be readily deployed in modern cloud-based platforms that are today's prevalent deployment choice. Further, the solution we develop will focus on reducing expert time dedicated to low-value tasks (e.g., triaging false positives or parsing through gigabytes of log records). Finally, I will design a strong evaluation strategy to demonstrate the validity of provenance-based approaches. This research is at the intersection of systems and applied machine learning. I envision my group contributing to systems observability research by developing trustworthy tools providing visibility into systems behavior and to machine learning applied to security by developing explainable graph-based intrusion detection solutions. As part of this research, my team will also work to integrate this new knowledge into robust open-source tools. These tools can then be used by industry practitioners to develop trustworthy security solutions.