{"id":"https://openalex.org/W3022067606","doi":"https://doi.org/10.1145/3391800.3398175","title":"Xanthus: Push-button Orchestration of Host Provenance Data Collection","display_name":"Xanthus: Push-button Orchestration of Host Provenance Data Collection","publication_year":2020,"publication_date":"2020-06-16","ids":{"openalex":"https://openalex.org/W3022067606","doi":"https://doi.org/10.1145/3391800.3398175","mag":"3022067606"},"language":"en","primary_location":{"id":"doi:10.1145/3391800.3398175","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3391800.3398175","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 3rd International Workshop on Practical Reproducible Evaluation of Computer Systems","raw_type":"proceedings-article"},"type":"article","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2005.04717","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Xueyuan Han","orcid":null},"institutions":[{"id":"https://openalex.org/I2801851002","display_name":"Harvard University Press","ror":"https://ror.org/006v7bf86","country_code":"US","type":"other","lineage":["https://openalex.org/I136199984","https://openalex.org/I2801851002"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Xueyuan Han","raw_affiliation_strings":["Harvard University, Cambridge, MA, USA"],"affiliations":[{"raw_affiliation_string":"Harvard University, Cambridge, MA, USA","institution_ids":["https://openalex.org/I2801851002"]}]},{"author_position":"middle","author":{"id":null,"display_name":"James Mickens","orcid":null},"institutions":[{"id":"https://openalex.org/I2801851002","display_name":"Harvard University Press","ror":"https://ror.org/006v7bf86","country_code":"US","type":"other","lineage":["https://openalex.org/I136199984","https://openalex.org/I2801851002"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"James Mickens","raw_affiliation_strings":["Harvard University, Cambridge, MA, USA"],"affiliations":[{"raw_affiliation_string":"Harvard University, Cambridge, MA, USA","institution_ids":["https://openalex.org/I2801851002"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Ashish Gehani","orcid":null},"institutions":[{"id":"https://openalex.org/I1298353152","display_name":"SRI International","ror":"https://ror.org/05s570m15","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I1298353152"]},{"id":"https://openalex.org/I4210099336","display_name":"Menlo School","ror":"https://ror.org/01240pn49","country_code":"US","type":"education","lineage":["https://openalex.org/I4210099336"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ashish Gehani","raw_affiliation_strings":["SRI International, Menlo Park, CA, USA"],"affiliations":[{"raw_affiliation_string":"SRI International, Menlo Park, CA, USA","institution_ids":["https://openalex.org/I1298353152","https://openalex.org/I4210099336"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Margo Seltzer","orcid":null},"institutions":[{"id":"https://openalex.org/I141945490","display_name":"University of British Columbia","ror":"https://ror.org/03rmrcq20","country_code":"CA","type":"education","lineage":["https://openalex.org/I141945490"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Margo Seltzer","raw_affiliation_strings":["University of British Columbia, Vancouver, BC, Canada"],"affiliations":[{"raw_affiliation_string":"University of British Columbia, Vancouver, BC, Canada","institution_ids":["https://openalex.org/I141945490"]}]},{"author_position":"last","author":{"id":null,"display_name":"Thomas Pasquier","orcid":null},"institutions":[{"id":"https://openalex.org/I36234482","display_name":"University of Bristol","ror":"https://ror.org/0524sp257","country_code":"GB","type":"education","lineage":["https://openalex.org/I36234482"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Thomas Pasquier","raw_affiliation_strings":["University of Bristol, Bristol, United Kingdom"],"affiliations":[{"raw_affiliation_string":"University of Bristol, Bristol, United Kingdom","institution_ids":["https://openalex.org/I36234482"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I2801851002"],"apc_list":null,"apc_paid":null,"fwci":0.3223,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.60998024,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":95},"biblio":{"volume":null,"issue":null,"first_page":"27","last_page":"32"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/orchestration","display_name":"Orchestration","score":0.807699978351593},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.6639000177383423},{"id":"https://openalex.org/keywords/trace","display_name":"TRACE (psycholinguistics)","score":0.635200023651123},{"id":"https://openalex.org/keywords/tracing","display_name":"Tracing","score":0.5501000285148621},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.491100013256073},{"id":"https://openalex.org/keywords/data-collection","display_name":"Data collection","score":0.4885999858379364},{"id":"https://openalex.org/keywords/audit-trail","display_name":"Audit trail","score":0.459199994802475},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.4348999857902527},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.3662000000476837}],"concepts":[{"id":"https://openalex.org/C199168358","wikidata":"https://www.wikidata.org/wiki/Q3367000","display_name":"Orchestration","level":3,"score":0.807699978351593},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7502999901771545},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.6639000177383423},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.635200023651123},{"id":"https://openalex.org/C138673069","wikidata":"https://www.wikidata.org/wiki/Q322229","display_name":"Tracing","level":2,"score":0.5501000285148621},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.491100013256073},{"id":"https://openalex.org/C133462117","wikidata":"https://www.wikidata.org/wiki/Q4929239","display_name":"Data collection","level":2,"score":0.4885999858379364},{"id":"https://openalex.org/C80958533","wikidata":"https://www.wikidata.org/wiki/Q1047174","display_name":"Audit trail","level":3,"score":0.459199994802475},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.4348999857902527},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3946000039577484},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.3662000000476837},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.3495999872684479},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.34700000286102295},{"id":"https://openalex.org/C2780586882","wikidata":"https://www.wikidata.org/wiki/Q7520643","display_name":"Simple (philosophy)","level":2,"score":0.32679998874664307},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.32260000705718994},{"id":"https://openalex.org/C147494362","wikidata":"https://www.wikidata.org/wiki/Q2078905","display_name":"Troubleshooting","level":2,"score":0.321399986743927},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3174999952316284},{"id":"https://openalex.org/C136197465","wikidata":"https://www.wikidata.org/wiki/Q1729295","display_name":"Variety (cybernetics)","level":2,"score":0.3158000111579895},{"id":"https://openalex.org/C489000","wikidata":"https://www.wikidata.org/wiki/Q747385","display_name":"Data flow diagram","level":2,"score":0.2851000130176544},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.27140000462532043},{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.2667999863624573},{"id":"https://openalex.org/C20136886","wikidata":"https://www.wikidata.org/wiki/Q749647","display_name":"Interoperability","level":2,"score":0.260699987411499},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2603999972343445},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.25920000672340393},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.2563000023365021}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1145/3391800.3398175","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3391800.3398175","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 3rd International Workshop on Practical Reproducible Evaluation of Computer Systems","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2005.04717","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2005.04717","pdf_url":"https://arxiv.org/pdf/2005.04717","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:research-information.bris.ac.uk:openaire/49ef338d-9fe8-450b-8309-4bdadd4f24bc","is_oa":true,"landing_page_url":"https://research-information.bris.ac.uk/en/publications/49ef338d-9fe8-450b-8309-4bdadd4f24bc","pdf_url":null,"source":{"id":"https://openalex.org/S4306400895","display_name":"Bristol Research (University of Bristol)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I36234482","host_organization_name":"University of Bristol","host_organization_lineage":["https://openalex.org/I36234482"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Han, X, Mickens, J, Gehani, A, Seltzer, M & Pasquier, T 2020, Xanthus : Push-button Orchestration of Host Provenance Data Collection. in ACM International Workshop on Practical Reproducible Evaluation of Systems. Association for Computing Machinery, pp. 27-32. https://doi.org/10.1145/3391800.3398175","raw_type":"contributionToPeriodical"},{"id":"pmh:oai:research-information.bris.ac.uk:publications/49ef338d-9fe8-450b-8309-4bdadd4f24bc","is_oa":true,"landing_page_url":"https://hdl.handle.net/1983/49ef338d-9fe8-450b-8309-4bdadd4f24bc","pdf_url":null,"source":{"id":"https://openalex.org/S7407055359","display_name":"Explore Bristol Research","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Han, X, Mickens, J, Gehani, A, Seltzer, M & Pasquier, T 2020, Xanthus : Push-button Orchestration of Host Provenance Data Collection. in ACM International Workshop on Practical Reproducible Evaluation of Systems. Association for Computing Machinery, pp. 27-32. https://doi.org/10.1145/3391800.3398175","raw_type":"contributionToPeriodical"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2005.04717","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2005.04717","pdf_url":"https://arxiv.org/pdf/2005.04717","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":42,"referenced_works":["https://openalex.org/W17915278","https://openalex.org/W168132470","https://openalex.org/W1444906800","https://openalex.org/W1548740378","https://openalex.org/W1591480890","https://openalex.org/W1931318777","https://openalex.org/W1981738628","https://openalex.org/W1988918299","https://openalex.org/W1999427165","https://openalex.org/W2031163547","https://openalex.org/W2041700825","https://openalex.org/W2046255282","https://openalex.org/W2103414007","https://openalex.org/W2118372007","https://openalex.org/W2127589913","https://openalex.org/W2158532686","https://openalex.org/W2161085373","https://openalex.org/W2167240430","https://openalex.org/W2258481386","https://openalex.org/W2284900416","https://openalex.org/W2468321486","https://openalex.org/W2544098645","https://openalex.org/W2601474892","https://openalex.org/W2614510834","https://openalex.org/W2732960953","https://openalex.org/W2747669027","https://openalex.org/W2755572540","https://openalex.org/W2773175795","https://openalex.org/W2789828921","https://openalex.org/W2790316935","https://openalex.org/W2790557990","https://openalex.org/W2807158246","https://openalex.org/W2885157095","https://openalex.org/W2916452359","https://openalex.org/W2944196828","https://openalex.org/W2947745012","https://openalex.org/W2951754944","https://openalex.org/W2962703433","https://openalex.org/W2982514609","https://openalex.org/W2998038410","https://openalex.org/W3006711782","https://openalex.org/W6633462303"],"related_works":[],"abstract_inverted_index":{"Host-based":[0],"anomaly":[1,15],"detectors":[2,16],"generate":[3,56],"alarms":[4],"by":[5],"inspecting":[6],"audit":[7,24,58],"logs":[8],"for":[9],"suspicious":[10],"behavior.":[11],"Unfortunately,":[12],"evaluating":[13],"these":[14],"is":[17,94],"hard.":[18],"There":[19],"are":[20,28],"few":[21],"high-quality,":[22],"publicly-available":[23],"logs,":[25],"and":[26,81,87,107],"there":[27],"no":[29],"pre-existing":[30],"frameworks":[31],"that":[32,51,79,85,114,124,131],"enable":[33],"push-button":[34],"creation":[35],"of":[36,117],"realistic":[37,57],"system":[38],"traces.":[39],"To":[40],"make":[41],"trace":[42,89,110],"generation":[43],"easier,":[44],"we":[45],"created":[46],"Xanthus,":[47],"an":[48],"automated":[49],"tool":[50],"orchestrates":[52],"virtual":[53],"machines":[54],"to":[55,76,133],"logs.":[59],"Using":[60],"Xanthus'":[61],"simple":[62],"management":[63],"interface,":[64],"administrators":[65],"select":[66],"a":[67,72,97],"base":[68],"VM":[69],"image,":[70],"configure":[71],"particular":[73],"tracing":[74],"framework":[75],"use":[77],"within":[78],"VM,":[80,103],"define":[82],"post-launch":[83],"scripts":[84],"collect":[86],"save":[88],"data.":[90,111],"Once":[91],"data":[92],"collection":[93],"finished,":[95],"Xanthus~creates":[96],"self-describing":[98],"archive,":[99],"which":[100],"contains":[101],"the":[102,108,118],"its":[104],"configuration":[105],"parameters,":[106],"collected":[109],"We":[112],"demonstrate":[113],"Xanthus~hides":[115],"many":[116],"tedious":[119],"(yet":[120],"subtle)":[121],"orchestration":[122],"tasks":[123],"humans":[125],"often":[126],"get":[127],"wrong;":[128],"Xanthus~avoids":[129],"mistakes":[130],"lead":[132],"non-replicable":[134],"experiments.":[135]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":1}],"updated_date":"2026-03-20T23:20:44.827607","created_date":"2020-05-13T00:00:00"}