ProvNavigator: shadow path guided attack investigation method
Year: 2025
Type: article
Abstract: After cyber attacks, conducting an investigation to analyze its root cause and impact is crucial. Currently, provenance graph-based techniques have become mainstream methods, but these methods face the challenge of dependency explosion problems. Recent research has alleviated this issue to some extent by integrating audit logs and application logs, showcasing advantages such as no need for program instrumentation, model training, or taint analysis. However, existing log fusion techniques either rely on complex fusion rules or require reverse engineering of applications, necessitating algorithm adjustments when facing new applications, which limits their general applicability. To address these issues, a new log fusion-based attack investigation method, ProvNavigator, was proposed. In the graph construction phase, individual provenance graphs from different log sources were merged into a global fused provenance graph by analyzing correlations between logs. In the attack investigation phase, nodes with dependency explosion were handled through “shadow path pairs,” and appropriate edges were selected to reconstruct the entire attack chain. ProvNavigator required no instrumentation or reverse analysis and demonstrated general applicability. A prototype system was developed and was experimentally evaluated in 6 real attack scenarios, including 4 DARPA TC datasets. The experimental results show that ProvNavigator can effectively reconstruct attack stories, achieving 94.3% precision with only 6.01% runtime overhead.
Authors: XI Hao, FAN Hao, YUAN Shenyang, ZHU Jinyu, CHEN Changhua, WAN Hai, ZHAO Xibin
Language: English
Topic: Digital and Cyber Forensics
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7005255023
FWCI:
Cites:
Cited by:
Related to: