Next Generation Provenance-based Intrusion Detection System

在世界范围内，对计算机系统的攻击对日常生活产生了不利影响，从爱荷华州的学校关闭，爱尔兰的医院预约取消，瑞典的超市关闭，到美国的燃料中断。特别值得关注的是高级持续性威胁（APT）攻击数量的增加。apt是由资源丰富、技术娴熟的攻击者设计的微妙的目标攻击。攻击者在几个月或几年的时间里扩展他们对系统的控制，然后最终发起潜在的破坏性攻击，在某些情况下，这种攻击可能会影响关键的基础设施。由于现代计算机系统的不透明性和复杂性，apt多年来一直未被发现。在过去的几年里，基于来源的入侵检测在学术安全社区被视为一种潜在的解决方案。来源是系统执行的有向无循环图的表示，它捕获了事件之间的因果关系，大大增加了系统的可观察性。入侵检测技术应用于这些图数据可以检测攻击和调查可疑行为。然而，由于一些根本原因，这种系统尚未得到广泛部署。首先，目前的学术原型和实验设置不适应当前的行业标准和实践。其次，全球安全人才短缺，使得攻击调查成为一项昂贵的努力。基于溯源的系统是不熟悉的，需要复杂的调查策略，导致采用成本高。最后，与更传统的入侵检测技术相比，学术评估标准相对较差，这使人们对其真正的有效性产生了怀疑。在提出的研究计划中，我将设计一个实用的端到端基于来源的入侵检测解决方案，满足当前的行业标准和实践。本研究的核心目标是设计一种解决方案，该解决方案可以轻松地部署在现代基于云的平台上，这是当今流行的部署选择。此外，我们开发的解决方案将专注于减少专家用于低价值任务的时间（例如，鉴别误报或解析千兆字节的日志记录）。最后，我将设计一个强大的评估策略来证明基于来源的方法的有效性。这项研究是系统和应用机器学习的交叉。我设想我的团队通过开发可信赖的工具来提供对系统行为的可见性，并通过开发可解释的基于图的入侵检测解决方案来将机器学习应用于安全，从而为系统可观察性研究做出贡献。作为这项研究的一部分，我的团队还将努力将这些新知识集成到健壮的开源工具中。然后，行业从业者可以使用这些工具来开发值得信赖的安全解决方案。

Worldwide, attacks on computer systems are adversely affecting everyday life, from schools closing in Iowa, cancellation of hospital appointments in Ireland, supermarkets closure in Sweden, to fuel disruption in the US. Of particular concern is the increased number of Advanced Persistent Threat (APT) attacks. APTs are subtle targeted attacks designed by well-resourced and skilled attackers. The attackers extend their control of a system over a period of months or years before finally launching a potentially devastating attack that can, in certain cases, affect critical infrastructures. APTs remain undetected for years due to the opacity and complexity of modern computer systems. Over the last few years, provenance-based intrusion detection has been heralded as a potential solution in the academic security community. Provenance is the representation of system execution as a directed acyclic graph that captures the causal relationship between events greatly increasing system observability. Intrusion detection techniques applied to this graph data can detect attacks and investigate suspicious behaviors. However, such systems have not been widely deployed for a few fundamental reasons. First, current academic prototypes and experimental setups are not adapted to current industry standards and practices. Second, there is a global shortage of security talent making attack investigation an expensive endeavor. Provenance-based systems are unfamiliar and require complex investigation strategies, leading to a high adoption cost. Finally, academic evaluation standards have been relatively poor when compared with more conventional intrusion detection techniques casting doubt upon their real effectiveness. In the proposed research program, I will design a practical end-to-end provenance-based intrusion detection solution that meets current industry standards and practices. A core objective of this research is to design a solution that can be readily deployed in modern cloud-based platforms that are today's prevalent deployment choice. Further, the solution we develop will focus on reducing expert time dedicated to low-value tasks (e.g., triaging false positives or parsing through gigabytes of log records). Finally, I will design a strong evaluation strategy to demonstrate the validity of provenance-based approaches. This research is at the intersection of systems and applied machine learning. I envision my group contributing to systems observability research by developing trustworthy tools providing visibility into systems behavior and to machine learning applied to security by developing explainable graph-based intrusion detection solutions. As part of this research, my team will also work to integrate this new knowledge into robust open-source tools. These tools can then be used by industry practitioners to develop trustworthy security solutions.