论文标题
通过人类的安全性分析实现有效的攻击调查
Enabling Efficient Attack Investigation via Human-in-the-Loop Security Analysis
论文作者
论文摘要
系统审核是收集系统呼叫事件的至关重要技术，作为系统出处并研究复杂的多步攻击，例如高级持续威胁。但是，由于大量的系统出处数据及其无法专注于攻击相关的部分，现有的攻击调查方法难以发现长时间的攻击序列。在本文中，我们介绍了Provexa，这是一种防御系统，使人类分析师能够有效地分析大型系统出处，以揭示多步攻击序列。 Provexa引入了一种表现力的域特异性语言PROVQL，该语言为各种类型的攻击分析（例如，攻击模式搜索，攻击依赖关系跟踪）提供了基本原始，并具有用户定义的约束，使分析师能够专注于攻击相关的部分，并通过大型出处数据进行迭代暂停。此外，Provexa提供了优化的执行引擎，以进行有效的语言执行。我们对广泛攻击情景的广泛评估表明，Provexa在促进及时攻击调查方面的实际有效性。
System auditing is a vital technique for collecting system call events as system provenance and investigating complex multi-step attacks such as Advanced Persistent Threats. However, existing attack investigation methods struggle to uncover long attack sequences due to the massive volume of system provenance data and their inability to focus on attack-relevant parts. In this paper, we present Provexa, a defense system that enables human analysts to effectively analyze large-scale system provenance to reveal multi-step attack sequences. Provexa introduces an expressive domain-specific language, ProvQL, that offers essential primitives for various types of attack analyses (e.g., attack pattern search, attack dependency tracking) with user-defined constraints, enabling analysts to focus on attack-relevant parts and iteratively sift through the large provenance data. Moreover, Provexa provides an optimized execution engine for efficient language execution. Our extensive evaluations on a wide range of attack scenarios demonstrate the practical effectiveness of Provexa in facilitating timely attack investigation.
