Forensics in Emerging Technologies

2026

1. RAID

   Effective and Efficient Threat Hunting with Small Language Models

   Saleha Muzammil, Rahul Reddy, Vishal Kamalakrishnan, Hadi Ahmadi, and Wajih Ul Hassan

   In International Symposium on Research in Attacks, Intrusions, and Defenses (RAID), 2026

   Abstract Bib PDF

   Analysts in Security Operations Centers query massive telemetry streams using Kusto Query Language (KQL), but writing correct KQL demands specialized expertise that bottlenecks scaling security teams. We investigate how Small Language Models (SLMs) can enable accurate, cost-effective translation from natural language queries (NLQs) to KQL. We propose a three-knob framework spanning prompting, fine-tuning, and architecture. First, we adapt NL2KQL for SLMs with lightweight retrieval and introduce error-aware prompting that targets common parser failures with a handful of mined tips, at a fraction of the tokens KQL’s full rule set would require. Second, we apply LoRA fine-tuning with rationale distillation, augmenting each NLQ-KQL pair with a brief chain-of-thought to transfer teacher reasoning. This yields an informative negative result, as neither variant surpasses targeted prompting. Third, we propose a two-stage architecture pairing an SLM drafter with a low-cost LLM judge for schema-aware refinement. We evaluate nine models (five SLMs, four LLMs) on syntax correctness, semantic accuracy, table selection, filter precision, latency, and token cost. On Microsoft’s NL2KQL Defender Evaluation dataset, our two-stage approach reaches 0.987 syntax and 0.906 schema-valid ("semantic") accuracy, exceeding every baseline we run under equivalent infrastructure, and it generalizes to independently authored queries over the same schema (0.964 syntax, 0.831 schema-valid). The only baselines within 0.05 schema-valid are NL2KQL+GPT-4o (0.878) and NL2KQL+GPT-5 (0.861), which cost 2.998 and 2.018 for 230 queries against $0.213 for ours, a 9.5-14× reduction at matched accuracy. These results establish SLMs as a practical foundation for natural-language querying in security operations.

   @inproceedings{muzammil2025towards,
     title = {Effective and Efficient Threat Hunting with Small Language Models},
     author = {Muzammil, Saleha and Reddy, Rahul and Kamalakrishnan, Vishal and Ahmadi, Hadi and Hassan, Wajih Ul},
     booktitle = {International Symposium on Research in Attacks, Intrusions, and Defenses (RAID)},
     year = {2026},
   }

2025

1. USENIX Security

   Principled and Automated Approach for Investigating AR/VR Attacks

   Muhammad Shoaib, Alex Suh, and Wajih Ul Hassan

   In USENIX Security Symposium, 2025

   Abstract Bib PDF

   As Augmented and Virtual Reality (AR/VR) adoption grows across sectors, auditing systems are needed to enable provenance analysis of AR/VR attacks. However, traditional auditing systems often generate inaccurate and incomplete provenance graphs, or fail to work due to operational restrictions in AR/VR devices. This paper presents REALITYCHECK, a provenance-based auditing system designed to support accurate root cause analysis and impact assessments of complex AR/VR attacks. Our system first enhances the W3C PROV data model with additional ontology to capture AR/VR-specific entities and causal relationships. Then, we employ a novel adaptation of natural language processing and feature-based log correlation techniques to transparently extract entities and relationships from dispersed, unstructured AR/VR logs into provenance graphs. Finally, we introduce an AR/VR-aware execution partitioning technique to filter out forensically irrelevant data and false causal relationships from these provenance graphs, improving analysis accuracy and investigation speed. We built a REALITYCHECK prototype for Meta Quest 2 and evaluated it against 25 real-world AR/VR attacks. The results show that REALITYCHECK generates accurate provenance graphs for all AR/VR attacks and incurs low runtime overhead across benchmarked applications. Notably, our execution partitioning approach drastically reduces the size of the graph without sacrificing essential investigation details. Our system operates non-intrusively, requires no additional installation, and is generalizable across various AR/VR devices.

   @inproceedings{realitycheck,
     title = {Principled and Automated Approach for Investigating AR/VR Attacks},
     author = {Shoaib, Muhammad and Suh, Alex and Hassan, Wajih Ul},
     year = {2025},
     booktitle = {USENIX Security Symposium},
   }

2. MobiHoc

   Demo: Investigating Immersive Attacks with REALITYCHECK

   Muhammad Shoaib, and Wajih Ul Hassan

   In First Workshop on Enhancing Security, Privacy, and Trust in Extended Reality (XR) Systems, 2025

   Abstract Bib PDF

   RealityCheck, recently published at USENIX Security 2025, is the first provenance-based auditing framework that enables comprehensive root-cause and impact analysis of complex attacks against Augmented/Virtual-Reality (AR/VR) head-mounted devices. This demonstration paper describes the live, hands-on instantiation of RealityCheck, highlighting how security analysts can transparently capture multi-layer logs from commodity headsets, automatically transform these heterogeneous traces into concise multilayer provenance graphs, and perform real-time exploratory queries to isolate attack causality. We demonstrate RealityCheck reconstructing an end-to-end provenance graph for the Object-in-the-middle attack, published at USENIX Security 2024, on a Meta Quest 2, achieving millisecond-level query latency with negligible runtime overhead.

   @inproceedings{demo-realitycheck,
     author = {Shoaib, Muhammad and Hassan, Wajih Ul},
     title = {Demo: Investigating Immersive Attacks with REALITYCHECK},
     year = {2025},
     booktitle = {First Workshop on Enhancing Security, Privacy, and Trust in Extended Reality (XR) Systems},
     doi = {10.1145/3704413.3765306}
   }

2018

1. NDSS

   Fear and Logging in the Internet of Things

   Qi Wang, Wajih Ul Hassan, Adam Bates, and Carl Gunter

   In Symposium on Network and Distributed System Security (NDSS), 2018

   Abstract Bib PDF

   As the Internet of Things (IoT) continues to proliferate, diagnosing incorrect behavior within increasinglyautomated homes becomes considerably more difficult. Devices and apps may be chained together in long sequences of triggeraction rules to the point that from an observable symptom (e.g., an unlocked door) it may be impossible to identify the distantly removed root cause (e.g., a malicious app).This is because, at present, IoT audit logs are siloed on individual devices, and hence cannot be used to reconstruct the causal relationships of complex workflows. In this work, we present ProvThings, a platform-centric approach to centralized auditing in the Internet of Things. ProvThings performs efficient automated instrumentation of IoT apps and device APIs in order to generate data provenance that provides a holistic explanation of system activities, including malicious behaviors. We prototype ProvThings for the Samsung SmartThings platform, and benchmark the efficacy of our approach against a corpus of 26 IoT attacks. Through the introduction of a selective code instrumentation optimization, we demonstrate in evaluation that ProvThings imposes just 5% overhead on physical IoT devices while enabling real time querying of system behaviors, and further consider how ProvThings can be leveraged to meet the needs of a variety of stakeholders in the IoT ecosystem.

   @inproceedings{provthings2018,
     title = {Fear and Logging in the Internet of Things},
     author = {Wang, Qi and Hassan, Wajih Ul and Bates, Adam and Gunter, Carl},
     year = {2018},
     booktitle = {Symposium on Network and Distributed System Security (NDSS)},
     doi = {10.14722/ndss.2018.23282}
   }

2017

1. WWW

   Transparent web service auditing via network provenance functions

   Adam Bates, Wajih Ul Hassan, Kevin Butler, Alin Dobra, Bradley Reaves, Patrick Cable, Thomas Moyer, and Nabil Schear

   In International World Wide Web Conference (WWW), 2017

   Abstract Bib PDF

   Detecting and explaining the nature of attacks in distributed web services is often difficult – determining the nature of suspicious activity requires following the trail of an attacker through a chain of heterogeneous software components including load balancers, proxies, worker nodes, and storage services. Unfortunately, existing forensic solutions cannot provide the necessary context to link events across complex workflows, particularly in instances where application layer semantics (e.g., SQL queries, RPCs) are needed to understand the attack. In this work, we present a transparent provenance-based approach for auditing web services through the introduction of Network Provenance Functions (NPFs). NPFs are a distributed architecture for capturing detailed data provenance for web service components, leveraging the key insight that mediation of an application’s protocols can be used to infer its activities without requiring invasive instrumentation or developer cooperation. We design and implement NPF with consideration for the complexity of modern cloud-based web services, and evaluate our architecture against a variety of applications including DVDStore, RUBiS, and WikiBench to show that our system imposes as little as 9.3% average end-to-end overhead on connections for realistic workloads. Finally, we consider several scenarios in which our system can be used to concisely explain attacks. NPF thus enables the hassle-free deployment of semantically rich provenance-based auditing for complex applications workflows in the Cloud.

   @inproceedings{bates2017transparent,
     title = {Transparent web service auditing via network provenance functions},
     author = {Bates, Adam and Hassan, Wajih Ul and Butler, Kevin and Dobra, Alin and Reaves, Bradley and Cable, Patrick and Moyer, Thomas and Schear, Nabil},
     year = {2017},
     booktitle = {International World Wide Web Conference (WWW)},
     doi = {10.1145/3038912.3052640}
   }