{"id":"https://openalex.org/W4416366699","doi":"https://doi.org/10.1109/tifs.2025.3634978","title":"FaaSTracker: Efficient Cross-Layer Provenance Tracking of Serverless Applications With Multi-Source Correlation","display_name":"FaaSTracker: Efficient Cross-Layer Provenance Tracking of Serverless Applications With Multi-Source Correlation","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4416366699","doi":"https://doi.org/10.1109/tifs.2025.3634978"},"language":null,"primary_location":{"id":"doi:10.1109/tifs.2025.3634978","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3634978","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5007183947","display_name":"Qingyang Zeng","orcid":"https://orcid.org/0009-0000-7077-005X"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]},{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qingyang Zeng","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China","Zhejiang University, China"],"raw_orcid":"https://orcid.org/0009-0000-7077-005X","affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]},{"raw_affiliation_string":"Zhejiang University, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5069544729","display_name":"Linjun Wu","orcid":"https://orcid.org/0000-0002-1988-0090"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]},{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lianjie Wu","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China","Zhejiang University, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]},{"raw_affiliation_string":"Zhejiang University, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028854046","display_name":"Kaiyu Hou","orcid":"https://orcid.org/0000-0002-7551-1345"},"institutions":[{"id":"https://openalex.org/I45928872","display_name":"Alibaba Group (China)","ror":"https://ror.org/00k642b80","country_code":"CN","type":"company","lineage":["https://openalex.org/I45928872"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kaiyu Hou","raw_affiliation_strings":["Alibaba Cloud Computing, Hangzhou, China","Alibaba Cloud Computing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Alibaba Cloud Computing, Hangzhou, China","institution_ids":["https://openalex.org/I45928872"]},{"raw_affiliation_string":"Alibaba Cloud Computing, China","institution_ids":["https://openalex.org/I45928872"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025080634","display_name":"Xue Leng","orcid":"https://orcid.org/0000-0003-1333-5988"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xue Leng","raw_affiliation_strings":["Hangzhou Institute of Technology, Xidian University, Hangzhou, China","Hangzhou Institute of Technology, Xidian University, China"],"raw_orcid":"https://orcid.org/0000-0003-1333-5988","affiliations":[{"raw_affiliation_string":"Hangzhou Institute of Technology, Xidian University, Hangzhou, China","institution_ids":["https://openalex.org/I149594827"]},{"raw_affiliation_string":"Hangzhou Institute of Technology, Xidian University, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100378166","display_name":"Yan Chen","orcid":"https://orcid.org/0000-0003-4103-1498"},"institutions":[{"id":"https://openalex.org/I111979921","display_name":"Northwestern University","ror":"https://ror.org/000e0be47","country_code":"US","type":"education","lineage":["https://openalex.org/I111979921"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yan Chen","raw_affiliation_strings":["Department of Computer Science, Northwestern University, Evanston, IL, USA","Northwestern University, USA"],"raw_orcid":"https://orcid.org/0000-0003-4103-1498","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Northwestern University, Evanston, IL, USA","institution_ids":["https://openalex.org/I111979921"]},{"raw_affiliation_string":"Northwestern University, USA","institution_ids":["https://openalex.org/I111979921"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.31444943,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"20","issue":null,"first_page":"12552","last_page":"12565"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.7592999935150146,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.7592999935150146,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.09830000251531601,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10101","display_name":"Cloud Computing and Resource Management","score":0.031599998474121094,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/workflow","display_name":"Workflow","score":0.6122999787330627},{"id":"https://openalex.org/keywords/function","display_name":"Function (biology)","score":0.5145999789237976},{"id":"https://openalex.org/keywords/provenance","display_name":"Provenance","score":0.4896000027656555},{"id":"https://openalex.org/keywords/construct","display_name":"Construct (python library)","score":0.46239998936653137},{"id":"https://openalex.org/keywords/metadata","display_name":"Metadata","score":0.4505999982357025},{"id":"https://openalex.org/keywords/tracking","display_name":"Tracking (education)","score":0.37119999527931213},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.33180001378059387}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8496999740600586},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.6122999787330627},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.5145999789237976},{"id":"https://openalex.org/C2780049196","wikidata":"https://www.wikidata.org/wiki/Q23582628","display_name":"Provenance","level":2,"score":0.4896000027656555},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.46239998936653137},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.4505999982357025},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3919000029563904},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3774000108242035},{"id":"https://openalex.org/C2775936607","wikidata":"https://www.wikidata.org/wiki/Q466845","display_name":"Tracking (education)","level":2,"score":0.37119999527931213},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.33180001378059387},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3294000029563904},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.31929999589920044},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.3041999936103821},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.28369998931884766},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.2822999954223633},{"id":"https://openalex.org/C113843644","wikidata":"https://www.wikidata.org/wiki/Q901882","display_name":"Interface (matter)","level":4,"score":0.2786000072956085},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.2736000120639801},{"id":"https://openalex.org/C31487907","wikidata":"https://www.wikidata.org/wiki/Q1154597","display_name":"Polygon mesh","level":2,"score":0.2727000117301941},{"id":"https://openalex.org/C20556612","wikidata":"https://www.wikidata.org/wiki/Q4469374","display_name":"Volume (thermodynamics)","level":2,"score":0.2574999928474426}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3634978","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3634978","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G5179338008","display_name":null,"funder_award_id":"CNS 2229454","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":37,"referenced_works":["https://openalex.org/W2213728018","https://openalex.org/W2902547091","https://openalex.org/W2962703433","https://openalex.org/W2978956219","https://openalex.org/W2988720726","https://openalex.org/W2998038410","https://openalex.org/W3006711782","https://openalex.org/W3008508243","https://openalex.org/W3011196476","https://openalex.org/W3012914409","https://openalex.org/W3015650867","https://openalex.org/W3016038045","https://openalex.org/W3084754580","https://openalex.org/W3127013462","https://openalex.org/W3134199133","https://openalex.org/W3138838255","https://openalex.org/W3155705005","https://openalex.org/W3164810656","https://openalex.org/W3166416521","https://openalex.org/W3179934812","https://openalex.org/W3197979949","https://openalex.org/W3202324008","https://openalex.org/W3216307713","https://openalex.org/W4205761438","https://openalex.org/W4288057803","https://openalex.org/W4308361873","https://openalex.org/W4308642220","https://openalex.org/W4310934754","https://openalex.org/W4323308647","https://openalex.org/W4386245196","https://openalex.org/W4386378095","https://openalex.org/W4388040908","https://openalex.org/W4394871711","https://openalex.org/W4396757579","https://openalex.org/W4402265033","https://openalex.org/W4402288660","https://openalex.org/W4408750016"],"related_works":[],"abstract_inverted_index":{"Serverless":[0],"computing,":[1],"also":[2,24],"known":[3],"as":[4],"Function-as-a-Service":[5],"(FaaS),":[6],"has":[7],"gained":[8],"popularity":[9],"due":[10],"to":[11,119,130,138],"its":[12,150],"flexibility,":[13],"scala":[14],"bility,":[15],"and":[16,31,70,148,167,173,177],"transparent":[17],"development.":[18],"However,":[19],"attacks":[20],"against":[21],"serverless":[22,154,159],"are":[23],"increasing.":[25],"Unfortunately,":[26],"complex":[27],"multi-layer":[28],"FaaS":[29],"architecture":[30],"frequently":[32],"launched":[33],"lightweight":[34],"functions":[35,65],"help":[36],"attackers":[37],"conceal":[38],"their":[39],"tracks.":[40],"Specifically,":[41],"(<italic":[42,58,72],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[43,59,73],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">i</i>)":[44],"fully":[45],"tracking":[46,100],"the":[47,120,145],"behavior":[48],"of":[49,56,135,170],"a":[50,92,113,132,164],"function":[51,67,78,102,108,136],"requires":[52],"crossing":[53],"multiple":[54,84,128],"layers":[55,111],"FaaS.":[57,105],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">ii</i>)":[60],"Intrusive":[61],"auditing":[62],"components":[63],"in":[64,104],"affect":[66],"startup":[68],"latency":[69],"performance.":[71],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">iii</i>)":[74],"Accurately":[75],"provenance":[76,96,133,160,171],"cross-layer":[77],"invocations":[79],"require":[80],"integrating":[81],"data":[82,126],"from":[83,127],"sources.":[85],"In":[86,122],"this":[87],"paper,":[88],"we":[89],"propose":[90],"FAASTRACKER,":[91],"cross-layer,":[93],"non-intrusive,":[94],"efficient":[95],"framework":[97],"for":[98],"accurately":[99],"user":[101],"behaviors":[103,109],"FAASTRACKER":[106,143,162],"tracks":[107],"across":[110],"using":[112,152],"non-intrusive":[114],"agent":[115],"without":[116],"any":[117],"modifications":[118],"function.":[121],"addition,":[123],"it":[124],"correlates":[125],"sources":[129],"construct":[131],"graph":[134],"workflows":[137],"locate":[139],"attackers.":[140],"We":[141],"implement":[142],"on":[144],"OpenFaaS":[146],"platform":[147],"evaluate":[149],"performance":[151],"real-world":[153],"applications.":[155],"Compared":[156],"with":[157],"state-of-the-art":[158],"systems,":[161],"provides":[163],"more":[165],"accurate":[166],"complete":[168],"view":[169],"graphs":[172],"reduces":[174],"54.0%":[175],"CPU":[176],"48.9%":[178],"memory":[179],"resources.":[180]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-11-19T00:00:00"}