{"id":"https://openalex.org/W4384948624","doi":"https://doi.org/10.1109/sp46215.2023.10179405","title":"SoK: History is a Vast Early Warning System: Auditing the Provenance of System Intrusions","display_name":"SoK: History is a Vast Early Warning System: Auditing the Provenance of System Intrusions","publication_year":2023,"publication_date":"2023-05-01","ids":{"openalex":"https://openalex.org/W4384948624","doi":"https://doi.org/10.1109/sp46215.2023.10179405"},"language":"en","primary_location":{"id":"doi:10.1109/sp46215.2023.10179405","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46215.2023.10179405","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5068126294","display_name":"Muhammad Adil Inam","orcid":"https://orcid.org/0000-0002-8347-1742"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Muhammad Adil Inam","raw_affiliation_strings":["University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yinfang Chen","orcid":null},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yinfang Chen","raw_affiliation_strings":["University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059987569","display_name":"Akul Goyal","orcid":"https://orcid.org/0000-0003-2484-6185"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Akul Goyal","raw_affiliation_strings":["University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089615083","display_name":"Jason Liu","orcid":"https://orcid.org/0000-0001-8173-6914"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jason Liu","raw_affiliation_strings":["University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5010662467","display_name":"Jaron Mink","orcid":"https://orcid.org/0000-0001-9390-3900"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jaron Mink","raw_affiliation_strings":["University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5033840812","display_name":"Noor Michael","orcid":"https://orcid.org/0000-0003-0320-7990"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Noor Michael","raw_affiliation_strings":["University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047211455","display_name":"Sneha Gaur","orcid":"https://orcid.org/0000-0001-8613-8286"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sneha Gaur","raw_affiliation_strings":["University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5021649580","display_name":"Adam Bates","orcid":"https://orcid.org/0000-0003-1511-4951"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Adam Bates","raw_affiliation_strings":["University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5089936565","display_name":"Wajih Ul Hassan","orcid":"https://orcid.org/0000-0002-5676-6027"},"institutions":[{"id":"https://openalex.org/I51556381","display_name":"University of Virginia","ror":"https://ror.org/0153tk833","country_code":"US","type":"education","lineage":["https://openalex.org/I51556381"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wajih Ul Hassan","raw_affiliation_strings":["University of Virginia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Virginia","institution_ids":["https://openalex.org/I51556381"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":49.948,"has_fulltext":false,"cited_by_count":58,"citation_normalized_percentile":{"value":0.99940793,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"2620","last_page":"2638"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9939000010490417,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7645249366760254},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.592329740524292},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.48500439524650574},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.48246198892593384},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.4558003544807434},{"id":"https://openalex.org/keywords/reduction","display_name":"Reduction (mathematics)","score":0.4111441373825073},{"id":"https://openalex.org/keywords/accounting","display_name":"Accounting","score":0.12026989459991455}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7645249366760254},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.592329740524292},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.48500439524650574},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.48246198892593384},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4558003544807434},{"id":"https://openalex.org/C111335779","wikidata":"https://www.wikidata.org/wiki/Q3454686","display_name":"Reduction (mathematics)","level":2,"score":0.4111441373825073},{"id":"https://openalex.org/C121955636","wikidata":"https://www.wikidata.org/wiki/Q4116214","display_name":"Accounting","level":1,"score":0.12026989459991455},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/sp46215.2023.10179405","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46215.2023.10179405","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":146,"referenced_works":["https://openalex.org/W95608104","https://openalex.org/W168132470","https://openalex.org/W205934778","https://openalex.org/W573378390","https://openalex.org/W982826035","https://openalex.org/W1495304983","https://openalex.org/W1858703999","https://openalex.org/W1880832170","https://openalex.org/W1909110254","https://openalex.org/W1920357401","https://openalex.org/W1968467415","https://openalex.org/W1975197166","https://openalex.org/W1984879109","https://openalex.org/W1986079362","https://openalex.org/W1996734614","https://openalex.org/W2009232481","https://openalex.org/W2028727337","https://openalex.org/W2033984447","https://openalex.org/W2049722158","https://openalex.org/W2070743098","https://openalex.org/W2081276694","https://openalex.org/W2087740020","https://openalex.org/W2090540886","https://openalex.org/W2096347345","https://openalex.org/W2106334604","https://openalex.org/W2108867737","https://openalex.org/W2111038628","https://openalex.org/W2116998101","https://openalex.org/W2117030266","https://openalex.org/W2123610299","https://openalex.org/W2125743503","https://openalex.org/W2128226234","https://openalex.org/W2137842875","https://openalex.org/W2141736438","https://openalex.org/W2144112223","https://openalex.org/W2152247885","https://openalex.org/W2152449272","https://openalex.org/W2156479376","https://openalex.org/W2161337603","https://openalex.org/W2162546229","https://openalex.org/W2170701348","https://openalex.org/W2191468669","https://openalex.org/W2213728018","https://openalex.org/W2229662347","https://openalex.org/W2234087692","https://openalex.org/W2267467826","https://openalex.org/W2284900416","https://openalex.org/W2291470926","https://openalex.org/W2293796484","https://openalex.org/W2317239415","https://openalex.org/W2400243382","https://openalex.org/W2471008588","https://openalex.org/W2482544674","https://openalex.org/W2532844970","https://openalex.org/W2560810941","https://openalex.org/W2579106964","https://openalex.org/W2579276500","https://openalex.org/W2601206855","https://openalex.org/W2603591188","https://openalex.org/W2614510834","https://openalex.org/W2747669027","https://openalex.org/W2755094099","https://openalex.org/W2766852928","https://openalex.org/W2767094836","https://openalex.org/W2772632044","https://openalex.org/W2790316935","https://openalex.org/W2790557990","https://openalex.org/W2792078641","https://openalex.org/W2792591096","https://openalex.org/W2793337260","https://openalex.org/W2885157095","https://openalex.org/W2889379876","https://openalex.org/W2889727957","https://openalex.org/W2891032614","https://openalex.org/W2897662483","https://openalex.org/W2947745012","https://openalex.org/W2954503794","https://openalex.org/W2962703433","https://openalex.org/W2978956219","https://openalex.org/W2995410217","https://openalex.org/W2998038410","https://openalex.org/W3006711782","https://openalex.org/W3007878096","https://openalex.org/W3008508243","https://openalex.org/W3008991042","https://openalex.org/W3015650867","https://openalex.org/W3016038045","https://openalex.org/W3094213939","https://openalex.org/W3099203541","https://openalex.org/W3109160943","https://openalex.org/W3110889769","https://openalex.org/W3137205257","https://openalex.org/W3138838255","https://openalex.org/W3176367300","https://openalex.org/W3195316970","https://openalex.org/W3195954353","https://openalex.org/W3211484264","https://openalex.org/W3212661259","https://openalex.org/W4225984940","https://openalex.org/W4226279402","https://openalex.org/W4226283591","https://openalex.org/W4229515876","https://openalex.org/W4245671428","https://openalex.org/W4288057708","https://openalex.org/W4288057803","https://openalex.org/W4298196474","https://openalex.org/W4299301436","https://openalex.org/W6605793882","https://openalex.org/W6606257881","https://openalex.org/W6607784307","https://openalex.org/W6607933944","https://openalex.org/W6625708980","https://openalex.org/W6628457668","https://openalex.org/W6630914723","https://openalex.org/W6631711945","https://openalex.org/W6633462303","https://openalex.org/W6634746302","https://openalex.org/W6637412253","https://openalex.org/W6637998620","https://openalex.org/W6639074551","https://openalex.org/W6639124891","https://openalex.org/W6639620801","https://openalex.org/W6640279344","https://openalex.org/W6640826072","https://openalex.org/W6660157426","https://openalex.org/W6678554285","https://openalex.org/W6686174896","https://openalex.org/W6689820708","https://openalex.org/W6701724222","https://openalex.org/W6712595259","https://openalex.org/W6712810931","https://openalex.org/W6713930180","https://openalex.org/W6737785282","https://openalex.org/W6743841043","https://openalex.org/W6751629095","https://openalex.org/W6753967410","https://openalex.org/W6754333932","https://openalex.org/W6754375631","https://openalex.org/W6763780955","https://openalex.org/W6782167706","https://openalex.org/W6792891848","https://openalex.org/W6793953445","https://openalex.org/W6794740203","https://openalex.org/W6796237833","https://openalex.org/W6801247658","https://openalex.org/W6803339927"],"related_works":["https://openalex.org/W2404937507","https://openalex.org/W2357468538","https://openalex.org/W3121186197","https://openalex.org/W1577110157","https://openalex.org/W2373849942","https://openalex.org/W151161666","https://openalex.org/W2364419519","https://openalex.org/W2360767377","https://openalex.org/W2017948608","https://openalex.org/W2360951146"],"abstract_inverted_index":{"Auditing,":[0],"a":[1,36,45,73,90,115,133],"central":[2],"pillar":[3],"of":[4,19,33,52,65,72,82,93,140,156,179,230],"operating":[5],"system":[6,53,109],"security,":[7],"has":[8],"only":[9],"recently":[10],"come":[11],"into":[12,44,114],"its":[13],"own":[14],"as":[15],"an":[16,152,176,196],"active":[17],"area":[18],"public":[20],"research.":[21],"This":[22],"resurgent":[23],"interest":[24],"is":[25],"due":[26],"in":[27,98,191],"large":[28],"part":[29],"to":[30,88,136,216],"the":[31,50,70,79,99,107,120,129,137,162,185,240],"notion":[32],"data":[34,220],"provenance,":[35],"technique":[37],"that":[38,48,128,171,210],"iteratively":[39],"parses":[40],"audit":[41,75,121,182],"log":[42,122,211,224],"entries":[43],"dependency":[46],"graph":[47],"explains":[49],"history":[51],"execution.":[54],"Provenance":[55],"facilitates":[56],"precise":[57],"threat":[58],"detection":[59,204],"and":[60,95,105,124,202],"investigation":[61],"through":[62],"causal":[63,141],"analysis":[64,125,142],"sophisticated":[66],"intrusion":[67],"behaviors.":[68],"However,":[69,206],"absence":[71],"foundational":[74],"literature,":[76,111],"combined":[77],"with":[78,219],"rapid":[80],"publication":[81],"recent":[83],"findings,":[84],"makes":[85],"it":[86],"difficult":[87],"gain":[89],"holistic":[91],"picture":[92],"advancements":[94],"open":[96],"challenges":[97],"area.In":[100],"this":[101,148],"work,":[102],"we":[103,144,194,207],"survey":[104],"categorize":[106],"provenance-based":[108],"auditing":[110],"distilling":[112],"contributions":[113],"layered":[116],"taxonomy":[117],"based":[118],"on":[119,147],"capture":[123],"pipeline.":[126],"Recognizing":[127],"Reduction":[130],"Layer":[131],"remains":[132],"key":[134],"obstacle":[135],"further":[138,146],"proliferation":[139],"technologies,":[143],"delve":[145],"issue":[149],"by":[150,227,234],"conducting":[151],"ambitious":[153],"independent":[154],"evaluation":[155],"8":[157],"exemplar":[158],"reduction":[159,212],"techniques":[160,213],"against":[161],"recently-released":[163],"DARPA":[164],"Transparent":[165],"Computing":[166],"datasets.":[167],"Our":[168],"experiments":[169],"uncover":[170],"past":[172],"approaches":[173],"frequently":[174],"prune":[175],"overlapping":[177],"set":[178],"activities":[180],"from":[181,188],"logs,":[183],"reducing":[184,223],"synergistic":[186],"benefits":[187],"applying":[189],"them":[190],"tandem;":[192],"further,":[193],"observe":[195,209],"inverse":[197],"relation":[198],"between":[199],"storage":[200],"efficiency":[201],"anomaly":[203],"performance.":[205],"also":[208],"are":[214],"able":[215],"synergize":[217],"effectively":[218],"compression,":[221],"potentially":[222],"retention":[225],"costs":[226],"multiple":[228],"orders":[229],"magnitude.":[231],"We":[232],"conclude":[233],"discussing":[235],"promising":[236],"future":[237],"directions":[238],"for":[239],"field.":[241]},"counts_by_year":[{"year":2026,"cited_by_count":9},{"year":2025,"cited_by_count":28},{"year":2024,"cited_by_count":17},{"year":2023,"cited_by_count":4}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}