PalanTír
Jun Zeng, Chuqi Zhang, Zhenkai Liang · Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security · 2022
System auditing is the foundation of attack provenance to investigate root causes and ramifications of cyber-attacks. However, provenance tracking on coarse-grained audit logs suffers from false causalities caused by dependency explosion. Recent approaches address this problem by increasing provenance granularity using execution partitioning or record-and-replay techniques. Unfortunately, they require program instrumentation and/or impose an unaffordable overhead, which is not practical in deployment.