Ning An

CSCProv: causal-semantic consistent provenance graph compression for attack detection

Abstract Provenance graphs have become an important foundation for attack investigation and anomaly detection in enterprise systems. However, system audit logs generate massive numbers of events, resulting in extremely large provenance graphs that not only hinder efficient securi...