{"id":"https://openalex.org/W7138205967","doi":"https://doi.org/10.48550/arxiv.2603.15216","title":"vCause: Efficient and Verifiable Causality Analysis for Cloud-based Endpoint Auditing","display_name":"vCause: Efficient and Verifiable Causality Analysis for Cloud-based Endpoint Auditing","publication_year":2026,"publication_date":"2026-03-16","ids":{"openalex":"https://openalex.org/W7138205967","doi":"https://doi.org/10.48550/arxiv.2603.15216"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2603.15216","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.15216","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2603.15216","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5001892361","display_name":"Qiyang Song","orcid":"https://orcid.org/0000-0002-1596-3331"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Song, Qiyang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011962388","display_name":"Qihang Zhou","orcid":"https://orcid.org/0000-0002-8565-1923"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhou, Qihang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015456692","display_name":"Xiaoqi Jia","orcid":"https://orcid.org/0000-0002-8376-3235"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jia, Xiaoqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5083941466","display_name":"Zhenyu Song","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Song, Zhenyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129746407","display_name":"Wenbo Jiang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jiang, Wenbo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129664010","display_name":"Heqing Huang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Huang, Heqing","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129670613","display_name":"Yong Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Yong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5129713319","display_name":"Dan Meng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Meng, Dan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.4999000132083893,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.4999000132083893,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11614","display_name":"Cloud Data Security Solutions","score":0.1216999962925911,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.10400000214576721,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/verifiable-secret-sharing","display_name":"Verifiable secret sharing","score":0.7770000100135803},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.6467999815940857},{"id":"https://openalex.org/keywords/causality","display_name":"Causality (physics)","score":0.6358000040054321},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.4474000036716461},{"id":"https://openalex.org/keywords/data-integrity","display_name":"Data integrity","score":0.41769999265670776},{"id":"https://openalex.org/keywords/scheme","display_name":"Scheme (mathematics)","score":0.4140999913215637},{"id":"https://openalex.org/keywords/security-analysis","display_name":"Security analysis","score":0.41130000352859497}],"concepts":[{"id":"https://openalex.org/C85847156","wikidata":"https://www.wikidata.org/wiki/Q59015987","display_name":"Verifiable secret sharing","level":3,"score":0.7770000100135803},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7554000020027161},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.6467999815940857},{"id":"https://openalex.org/C64357122","wikidata":"https://www.wikidata.org/wiki/Q1149766","display_name":"Causality (physics)","level":2,"score":0.6358000040054321},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.613099992275238},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.4474000036716461},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.41769999265670776},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.4140999913215637},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.41130000352859497},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.4099999964237213},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.3386000096797943},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.322299987077713},{"id":"https://openalex.org/C2777402240","wikidata":"https://www.wikidata.org/wiki/Q6783436","display_name":"Masking (illustration)","level":2,"score":0.32109999656677246},{"id":"https://openalex.org/C62611344","wikidata":"https://www.wikidata.org/wiki/Q1062658","display_name":"Node (physics)","level":2,"score":0.29910001158714294},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.29089999198913574},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.28600001335144043},{"id":"https://openalex.org/C80958533","wikidata":"https://www.wikidata.org/wiki/Q1047174","display_name":"Audit trail","level":3,"score":0.2727000117301941},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.25839999318122864},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.25040000677108765},{"id":"https://openalex.org/C28719098","wikidata":"https://www.wikidata.org/wiki/Q44946","display_name":"Point (geometry)","level":2,"score":0.25029999017715454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2603.15216","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.15216","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2603.15216","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.15216","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.7085866928100586}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"In":[0],"cloud-based":[1,115],"endpoint":[2,116],"auditing,":[3],"security":[4,99,162],"administrators":[5,43],"often":[6],"rely":[7],"on":[8,149,182,186],"the":[9,26,37,59,67,187],"cloud":[10,27],"to":[11,20,52,65,91],"perform":[12],"causality":[13,39,70,93,111,142,175],"analysis":[14,40,94,112,163,176],"over":[15],"log-derived":[16],"versioned":[17,151],"provenance":[18,130,152],"graphs":[19],"investigate":[21],"suspicious":[22],"attack":[23,48],"behaviors.":[24],"However,":[25],"may":[28,44],"be":[29],"distrusted":[30],"or":[31],"compromised":[32],"by":[33],"attackers,":[34],"potentially":[35],"manipulating":[36],"final":[38],"results.":[41],"Consequently,":[42],"not":[45,88],"accurately":[46],"understand":[47],"behaviors":[49],"and":[50,77,95,100,109,127,154,164,173,184],"fail":[51],"implement":[53],"effective":[54],"countermeasures.":[55],"This":[56,103],"risk":[57],"underscores":[58],"need":[60],"for":[61,83,114],"a":[62,124,128,146,150],"defense":[63],"scheme":[64],"ensure":[66],"integrity":[68],"of":[69,137],"analysis.":[71],"While":[72],"existing":[73],"tamper-evident":[74],"logging":[75],"schemes":[76],"trusted":[78],"execution":[79],"environments":[80],"show":[81,167],"promise":[82],"this":[84],"task,":[85],"they":[86],"are":[87],"specifically":[89],"designed":[90],"support":[92],"thus":[96],"face":[97],"inherent":[98],"efficiency":[101],"limitations.":[102],"paper":[104],"presents":[105],"vCause,":[106],"an":[107],"efficient":[108],"verifiable":[110,129,174],"system":[113],"auditing.":[117],"vCause":[118,169],"integrates":[119],"two":[120,138],"authenticated":[121],"data":[122,133],"structures:":[123],"graph":[125],"accumulator":[126],"graph.":[131],"The":[132],"structures":[134],"enable":[135],"validation":[136],"critical":[139],"steps":[140],"in":[141],"analysis:":[143],"(i)":[144],"querying":[145],"point-of-interest":[147],"node":[148],"graph,":[153],"(ii)":[155],"identifying":[156],"its":[157],"causally":[158],"related":[159],"components.":[160],"Formal":[161],"experimental":[165],"evaluation":[166],"that":[168],"can":[170],"achieve":[171],"secure":[172],"with":[177],"only":[178],"<1%":[179],"computational":[180],"overhead":[181],"endpoints":[183],"3.36%":[185],"cloud.":[188]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-03-18T00:00:00"}