Provenance-based intrusion detection

Abstract

In the current cyber threat landscape, intrusion detection is imperative. With the increasing complexity of cyber threats such as Advanced Persistent Threats, using just traditional Intrusion Detection Systems can face issues like high false positive rate and difficulty detecting such cyber threats. Provenance-based intrusion detection systems which uses provenance data and provenance graphs can help tackle these issues as it captures system entity interactions to better detect these threats. This project will document the setup of CamFlow and Flurry which are used to capture provenance data and generate provenance graphs. We then generate datasets with modified scripts to enhance the quality of the data. This project aims to find out the effectiveness of provenance data and provenance graph by using a GCN model. We will conclude the project by evaluating our model to determine the effectiveness of the model using different metrics and comparing against existing models.