{"id":"https://openalex.org/W2579106964","doi":"https://doi.org/10.14722/ndss.2016.23350","title":"ProTracer: Towards Practical Provenance Tracing by Alternating Between Logging and Tainting","display_name":"ProTracer: Towards Practical Provenance Tracing by Alternating Between Logging and Tainting","publication_year":2016,"publication_date":"2016-01-01","ids":{"openalex":"https://openalex.org/W2579106964","doi":"https://doi.org/10.14722/ndss.2016.23350","mag":"2579106964"},"language":"en","primary_location":{"id":"doi:10.14722/ndss.2016.23350","doi":"https://doi.org/10.14722/ndss.2016.23350","is_oa":true,"landing_page_url":"https://doi.org/10.14722/ndss.2016.23350","pdf_url":"https://doi.org/10.14722/ndss.2016.23350","source":{"id":"https://openalex.org/S4306420590","display_name":"Network and Distributed System Security Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings 2016 Network and Distributed System Security Symposium","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://doi.org/10.14722/ndss.2016.23350","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101594068","display_name":"Shiqing Ma","orcid":"https://orcid.org/0000-0003-1551-8948","observed_orcids":["https://orcid.org/0000-0003-1551-8948"]},"institutions":[{"id":"https://openalex.org/I219193219","display_name":"Purdue University West Lafayette","ror":"https://ror.org/02dqehb95","country_code":"US","type":"education","lineage":["https://openalex.org/I219193219"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Shiqing Ma","raw_affiliation_strings":["Purdue University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Purdue University","institution_ids":["https://openalex.org/I219193219"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5107249133","display_name":"Xiangyu Zhang","orcid":"https://orcid.org/0000-0002-9544-2500","observed_orcids":["https://orcid.org/0000-0002-9544-2500","https://orcid.org/0000-0003-3269-4345"]},"institutions":[{"id":"https://openalex.org/I219193219","display_name":"Purdue University West Lafayette","ror":"https://ror.org/02dqehb95","country_code":"US","type":"education","lineage":["https://openalex.org/I219193219"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xiangyu Zhang","raw_affiliation_strings":["Purdue University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Purdue University","institution_ids":["https://openalex.org/I219193219"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5108280598","display_name":"Dongyan Xu","orcid":"https://orcid.org/0000-0002-9892-8733","observed_orcids":["https://orcid.org/0000-0002-9892-8733"]},"institutions":[{"id":"https://openalex.org/I219193219","display_name":"Purdue University West Lafayette","ror":"https://ror.org/02dqehb95","country_code":"US","type":"education","lineage":["https://openalex.org/I219193219"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dongyan Xu","raw_affiliation_strings":["Purdue University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Purdue University","institution_ids":["https://openalex.org/I219193219"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I219193219"],"apc_list":null,"apc_paid":null,"fwci":14.8224,"has_fulltext":true,"cited_by_count":218,"citation_normalized_percentile":{"value":0.99426729,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9243000149726868,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9243000149726868,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0284000001847744,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.016899999231100082,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/provenance-tracking","display_name":"provenance tracking","score":0.9959999918937683},{"id":"https://openalex.org/keywords/advanced-persistent-threats","display_name":"advanced persistent threats","score":0.8109999895095825},{"id":"https://openalex.org/keywords/attack-detection","display_name":"attack detection","score":0.6919999718666077},{"id":"https://openalex.org/keywords/taint-propagation","display_name":"taint propagation","score":0.9129999876022339},{"id":"https://openalex.org/keywords/kernel-module","display_name":"kernel module","score":0.5849999785423279},{"id":"https://openalex.org/keywords/spatial-efficiency","display_name":"space efficiency","score":0.38199999928474426},{"id":"https://openalex.org/keywords/runtime-overhead","display_name":"runtime overhead","score":0.8180000185966492}],"concepts":[{"id":"https://openalex.org/C138673069","wikidata":"https://www.wikidata.org/wiki/Q322229","display_name":"Tracing","level":2,"score":0.8173227310180664},{"id":"https://openalex.org/C2780049196","wikidata":"https://www.wikidata.org/wiki/Q23582628","display_name":"Provenance","level":2,"score":0.7151637077331543},{"id":"https://openalex.org/C125620115","wikidata":"https://www.wikidata.org/wiki/Q845249","display_name":"Logging","level":2,"score":0.6725869178771973},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5514250993728638},{"id":"https://openalex.org/C39432304","wikidata":"https://www.wikidata.org/wiki/Q188847","display_name":"Environmental science","level":0,"score":0.3259482681751251},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.21679019927978516},{"id":"https://openalex.org/C97137747","wikidata":"https://www.wikidata.org/wiki/Q38112","display_name":"Forestry","level":1,"score":0.19885560870170593},{"id":"https://openalex.org/C205649164","wikidata":"https://www.wikidata.org/wiki/Q1071","display_name":"Geography","level":0,"score":0.14072996377944946},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.1388283669948578},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.06567516922950745}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.14722/ndss.2016.23350","doi":"https://doi.org/10.14722/ndss.2016.23350","is_oa":true,"landing_page_url":"https://doi.org/10.14722/ndss.2016.23350","pdf_url":"https://doi.org/10.14722/ndss.2016.23350","source":{"id":"https://openalex.org/S4306420590","display_name":"Network and Distributed System Security Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings 2016 Network and Distributed System Security Symposium","raw_type":"proceedings-article"},{"id":"pmh:oai:alma.01RUT_INST:11695743110004646","doi":null,"is_oa":false,"landing_page_url":"https://scholarship.libraries.rutgers.edu/esploro/outputs/conferencePaper/ProTracer-towards-practical-provenance-tracing-by/991031794682804646","pdf_url":null,"source":{"id":"https://openalex.org/S4306401388","display_name":"Rutgers University Community Repository (Rutgers University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I102322142","host_organization_name":"Rutgers, The State University of New Jersey","host_organization_lineage":["https://openalex.org/I102322142"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Conference Paper"}],"best_oa_location":{"id":"doi:10.14722/ndss.2016.23350","doi":"https://doi.org/10.14722/ndss.2016.23350","is_oa":true,"landing_page_url":"https://doi.org/10.14722/ndss.2016.23350","pdf_url":"https://doi.org/10.14722/ndss.2016.23350","source":{"id":"https://openalex.org/S4306420590","display_name":"Network and Distributed System Security Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings 2016 Network and Distributed System Security Symposium","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G2304153372","display_name":null,"funder_award_id":"N000141410468","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"},{"id":"https://openalex.org/G4764891271","display_name":null,"funder_award_id":"FA-8650-15-C-7562","funder_id":"https://openalex.org/F4320332180","funder_display_name":"Defense Advanced Research Projects Agency"},{"id":"https://openalex.org/G5022095762","display_name":null,"funder_award_id":"FA8650-15C","funder_id":"https://openalex.org/F4320332180","funder_display_name":"Defense Advanced Research Projects Agency"},{"id":"https://openalex.org/G7991439394","display_name":"TWC: Medium: Collaborative: Towards a Binary-Centric Framework for Cyber Forensics in Enterprise Environments","funder_award_id":"1409668","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320307791","display_name":"Cisco Systems","ror":"https://ror.org/03yt1ez60"},{"id":"https://openalex.org/F4320332180","display_name":"Defense Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"},{"id":"https://openalex.org/F4320337345","display_name":"Office of Naval Research","ror":"https://ror.org/00rk2pe57"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2579106964.pdf","grobid_xml":"https://content.openalex.org/works/W2579106964.grobid-xml"},"referenced_works_count":40,"referenced_works":["https://openalex.org/W47175211","https://openalex.org/W1444906800","https://openalex.org/W1499241274","https://openalex.org/W1559528097","https://openalex.org/W1563677467","https://openalex.org/W1584150393","https://openalex.org/W1683791865","https://openalex.org/W1684864276","https://openalex.org/W1813893391","https://openalex.org/W1858703999","https://openalex.org/W1963971515","https://openalex.org/W2081276694","https://openalex.org/W2089745089","https://openalex.org/W2093406244","https://openalex.org/W2096347345","https://openalex.org/W2102970979","https://openalex.org/W2116682495","https://openalex.org/W2119251836","https://openalex.org/W2129167530","https://openalex.org/W2132185316","https://openalex.org/W2133089788","https://openalex.org/W2137842875","https://openalex.org/W2144789413","https://openalex.org/W2145969515","https://openalex.org/W2148135249","https://openalex.org/W2151135920","https://openalex.org/W2158438481","https://openalex.org/W2159357881","https://openalex.org/W2213728018","https://openalex.org/W2226445952","https://openalex.org/W2234087692","https://openalex.org/W2293351723","https://openalex.org/W2295705535","https://openalex.org/W2397699236","https://openalex.org/W2400243382","https://openalex.org/W2401617229","https://openalex.org/W4230176856","https://openalex.org/W4238764625","https://openalex.org/W4245671428","https://openalex.org/W4255411440"],"related_works":["https://openalex.org/W2794385034","https://openalex.org/W3185502221","https://openalex.org/W2888349659","https://openalex.org/W4315630210","https://openalex.org/W4388481469","https://openalex.org/W7150791207","https://openalex.org/W4413277238","https://openalex.org/W4412402622","https://openalex.org/W4375928927","https://openalex.org/W7125934200"],"abstract_inverted_index":{"Provenance":[0],"tracing":[1,42],"is":[2,56,119],"a":[3,39,67,73,92,151],"very":[4,68],"important":[5,115],"approach":[6],"to":[7],"Advanced":[8],"Persistent":[9],"Threat":[10],"(APT)":[11],"attack":[12,95,147],"detection":[13],"and":[14,28,50,72,81,91,107,141],"investigation.Existing":[15],"techniques":[16,159],"either":[17],"suffer":[18],"from":[19],"the":[20,124],"dependence":[21],"explosion":[22],"problem":[23],"or":[24],"have":[25],"non-trivial":[26],"space":[27,76,117],"runtime":[29],"overhead,":[30],"which":[31],"hinder":[32],"their":[33],"application":[34],"in":[35,109],"practice.We":[36],"propose":[37],"ProTracer,":[38],"lightweight":[40,69],"provenance":[41],"system":[43,47,61,89],"that":[44,65,78,98],"alternates":[45],"between":[46],"event":[48,62,83],"logging":[49],"unit":[51],"level":[52],"taint":[53],"propagation.The":[54],"technique":[55],"built":[57],"on":[58],"an":[59,130],"on-the-fly":[60],"processing":[63],"infrastructure":[64],"features":[66],"kernel":[70],"module":[71],"sophisticated":[74],"user":[75],"daemon":[77],"performs":[79],"concurrent":[80],"out-of-order":[82],"processing.The":[84],"evaluation":[85],"with":[86],"different":[87],"realistic":[88],"workloads":[90],"number":[93],"of":[94,123],"cases":[96],"show":[97],"ProTracer":[99],"only":[100,120],"produces":[101],"13MB":[102],"log":[103],"data":[104],"per":[105],"day,":[106],"0.84GB(Server)/2.32GB(Client)":[108],"3":[110],"months":[111],"without":[112],"losing":[113],"any":[114],"information.The":[116],"consumption":[118],"<":[121],"1.28%":[122],"state-of-the-art,":[125],"7":[126],"times":[127,153],"smaller":[128,154],"than":[129,155],"off-line":[131],"garbage":[132],"collection":[133],"technique.The":[134],"run-time":[135],"overhead":[136],"averages":[137],"<7%":[138],"for":[139,143],"servers":[140],"<5%":[142],"regular":[144],"applications.The":[145],"generated":[146],"causal":[148],"graphs":[149],"are":[150,162],"few":[152],"those":[156],"by":[157],"existing":[158],"while":[160],"they":[161],"equally":[163],"informative.":[164]},"counts_by_year":[{"year":2026,"cited_by_count":12},{"year":2025,"cited_by_count":22},{"year":2024,"cited_by_count":28},{"year":2023,"cited_by_count":21},{"year":2022,"cited_by_count":19},{"year":2021,"cited_by_count":22},{"year":2020,"cited_by_count":26},{"year":2019,"cited_by_count":17},{"year":2018,"cited_by_count":29},{"year":2017,"cited_by_count":14},{"year":2016,"cited_by_count":8}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2017-01-26T00:00:00"}