Flurry: A Fast Framework for Provenance Graph Generation for Representation Learning
Maya Kapoor, Joshua Melton, Michael Ridenhour, Thomas Moyer, Siddharth Krishnan · Proceedings of the 31st ACM International Conference on Information & Knowledge Management · 2022
Representation learning and deep learning on data provenance graphs has yielded insightful new angles for intrusion detection in cybersecurity systems and is rapidly expanding as a research topic in the scientific community. In order to train the learning models, system execution data must be created and captured which represent realistic cyberattacks of a wide variety. Furthermore, these graphs must contain equally authentic benign workflows relative to the host and its multi-faceted processes. In order to support dynamic generation of provenance graphs to rapidly train new provenance graph learning models, we present Flurry, an end-to-end framework which simulates attack and benign activity and generates provenance graphs in multiple formats exportable to graph learning systems. In this demonstration, we showcase Flurry's ability to simulate both pre-configured and user-defined cyberattacks as well as benign behavior, and convert these captures into provenance graphs. We investigate the spectral properties of these graphs and perform attack classification experiments comparing three graph neural network models. Our results are comparable to those in the original learning models' research papers, showing that the Flurry graphs provide an ideal baseline and an extensible framework for graph representation learning on provenance graphs. In our demo, we show that Flurry will bring brand-new expandability and proficiency to the provenance graph learning community's available data.