Publications | DART Lab

2026

RAID
No Data? No Problem: Synthesizing Security Graphs for Better Intrusion Detection

Yi Huang, Shaofei Li, Yao Guo, Xiangqun Chen, Wajih Ul Hassan, and Ding Li

In International Symposium on Research in Attacks, Intrusions, and Defenses (RAID), 2026

Abstract Bib PDF

Provenance graph analysis plays a vital role in intrusion detection, particularly against Advanced Persistent Threats (APTs), by exposing complex attack patterns. While recent systems combine graph neural networks (GNNs) with natural language processing (NLP) to capture structural and semantic features, their effectiveness is limited by class imbalance in real-world data. To address this, we introduce PROVSYN, a novel hybrid provenance graph synthesis framework, which comprises three components: (1) graph structure synthesis via heterogeneous graph generation models, (2) textual attribute synthesis via fine-tuned Large Language Models (LLMs), and (3) five-dimensional fidelity evaluation. Experiments on six benchmark datasets demonstrate that PROVSYN consistently produces higher-fidelity graphs across the five evaluation dimensions compared to four strong baselines. To further demonstrate the practical utility of PROVSYN, we utilize the synthesized graphs to augment training datasets for downstream APT detection models. The results show that PROVSYN effectively mitigates data imbalance, improving normalized entropy by up to 0.35 in absolute terms, and enhances the generalizability of downstream detection models, yielding an absolute increase of up to 0.38 in balanced accuracy.
@inproceedings{provsyn, title = {No Data? No Problem: Synthesizing Security Graphs for Better Intrusion Detection}, author = {Huang, Yi and Li, Shaofei and Guo, Yao and Chen, Xiangqun and Hassan, Wajih Ul and Li, Ding}, booktitle = {International Symposium on Research in Attacks, Intrusions, and Defenses (RAID)}, year = {2026}, doi = {10.48550/arXiv.2506.06226} }
RAID
Effective and Efficient Threat Hunting with Small Language Models

Saleha Muzammil, Rahul Reddy, Vishal Kamalakrishnan, Hadi Ahmadi, and Wajih Ul Hassan

In International Symposium on Research in Attacks, Intrusions, and Defenses (RAID), 2026

Abstract Bib PDF

Analysts in Security Operations Centers query massive telemetry streams using Kusto Query Language (KQL), but writing correct KQL demands specialized expertise that bottlenecks scaling security teams. We investigate how Small Language Models (SLMs) can enable accurate, cost-effective translation from natural language queries (NLQs) to KQL. We propose a three-knob framework spanning prompting, fine-tuning, and architecture. First, we adapt NL2KQL for SLMs with lightweight retrieval and introduce error-aware prompting that targets common parser failures with a handful of mined tips, at a fraction of the tokens KQL’s full rule set would require. Second, we apply LoRA fine-tuning with rationale distillation, augmenting each NLQ-KQL pair with a brief chain-of-thought to transfer teacher reasoning. This yields an informative negative result, as neither variant surpasses targeted prompting. Third, we propose a two-stage architecture pairing an SLM drafter with a low-cost LLM judge for schema-aware refinement. We evaluate nine models (five SLMs, four LLMs) on syntax correctness, semantic accuracy, table selection, filter precision, latency, and token cost. On Microsoft’s NL2KQL Defender Evaluation dataset, our two-stage approach reaches 0.987 syntax and 0.906 schema-valid ("semantic") accuracy, exceeding every baseline we run under equivalent infrastructure, and it generalizes to independently authored queries over the same schema (0.964 syntax, 0.831 schema-valid). The only baselines within 0.05 schema-valid are NL2KQL+GPT-4o (0.878) and NL2KQL+GPT-5 (0.861), which cost 2.998 and 2.018 for 230 queries against $0.213 for ours, a 9.5-14× reduction at matched accuracy. These results establish SLMs as a practical foundation for natural-language querying in security operations.
@inproceedings{muzammil2025towards, title = {Effective and Efficient Threat Hunting with Small Language Models}, author = {Muzammil, Saleha and Reddy, Rahul and Kamalakrishnan, Vishal and Ahmadi, Hadi and Hassan, Wajih Ul}, booktitle = {International Symposium on Research in Attacks, Intrusions, and Defenses (RAID)}, year = {2026}, }
PRISM @ NDSS
Private Yet Accurate: A Decentralized Approach to System Intrusion Detection

Jinghan Zhang, Mati Ur Rehman, Sharon Biju, Saleha Muzammil, and Wajih Ul Hassan

In Workshop on Attack Provenance, Reasoning, and Investigation for Security in the Monitored Environment (PRISM), 2026

Abstract Bib PDF

We present MIRAGE, the first privacy-preserving Provenance-based IDS (PIDS) that integrates Federated Learning (FL) with graph representation learning to match centralized detection accuracy while preserving privacy and improving scalability. Building MIRAGE is non-trivial due to challenges in federating graph-based models across clients with heterogeneous logs, inconsistent semantic encodings, and temporally misaligned data. To address these challenges, MIRAGE introduces a novel process entity categorization-based ensemble, where specialized submodels learn distinct system behaviors and avoid aggregation errors. To enable privacy-preserving semantic alignment, MIRAGE designs a dual-server harmonization framework: one server issues encryption keys, and the other aggregates encrypted embeddings without accessing sensitive tokens. To remain robust to temporal misalignment across clients, MIRAGE employs inductive GNNs that eliminate the need for synchronized timestamps. Evaluations on DARPA datasets show that MIRAGE matches the detection accuracy of state-of-the-art PIDS and reduces network communication costs by 170×, processes datasets in minutes rather than hours.
@inproceedings{zhang2026mirage, title = {Private Yet Accurate: A Decentralized Approach to System Intrusion Detection}, author = {Zhang, Jinghan and Rehman, Mati Ur and Biju, Sharon and Muzammil, Saleha and Hassan, Wajih Ul}, booktitle = {Workshop on Attack Provenance, Reasoning, and Investigation for Security in the Monitored Environment (PRISM)}, year = {2026}, publisher = {NDSS Symposium}, doi = {10.14722/prism.2026.23018} }
IEEE S&P
Catch Me If You Can: Detector-Resistant Evasion via Semantics-Preserving Command Re-Realization

Muhammad Shoaib, Hare Sudhan Muthusamy, Tareq Alkhatib, and Wajih Ul Hassan

In IEEE Symposium on Security and Privacy (S&P), 2026

Abstract Bib PDF

Red teams require evasion techniques to test Security Information and Event Management (SIEM) detection rules, yet existing approaches are (1) manual, (2) rely on string-level obfuscations (such as encoding schemes and quoting tricks) that are easily reversed by de-obfuscators, and (3) provide limited rule coverage. This leaves unexplored semantic-preserving evasions that achieve identical effects through different utilities, preventing assessment of whether rules detect attack intent or merely surface patterns. We present SPEC- TRA, an automated evasion generator that preserves attack effects while transforming command-line realization through functionally equivalent utilities and argument structures. By reasoning over semantic representations rather than syntactic patterns, SPECTRA automatically generates more durable and effective evasions. On Windows Sigma process_creation rules, SPECTRA achieves 72.9% rule coverage compared to 37.6% for AMIDES (the state-of-the-art method), with only 4.5% of evasions reversed by de-obfuscators versus 78.1% for AMIDES (17.4 times more resistant). When evaluated against the state-of-the-art evasion detector at its zero-false-positive operating point, SPECTRA achieves a detection rate of only 22.7% compared to 69.9% for AMIDES. SPECTRA also outperforms five general-purpose LLMs across metrics.
@inproceedings{shoaib2026spectra, title = {Catch Me If You Can: Detector-Resistant Evasion via Semantics-Preserving Command Re-Realization}, author = {Shoaib, Muhammad and Muthusamy, Hare Sudhan and Alkhatib, Tareq and Hassan, Wajih Ul}, booktitle = {IEEE Symposium on Security and Privacy (S\&P)}, year = {2026}, publisher = {IEEE}, doi = {10.1109/sp63933.2026.00159} }
TDSC
Accurate and Scalable Detection and Investigation of Cyber Persistence Threats

Qi Liu, Muhammad Shoaib, Mati Ur Rehman, Kaibin Bao, Veit Hagenmeyer, and Wajih Ul Hassan

Transactions on Dependable and Secure Computing, 2026

Abstract Bib PDF

In Advanced Persistent Threat (APT) attacks, achieving stealthy persistence within target systems is often crucial for an attacker’s success. This persistence allows adversaries to maintain prolonged access, often evading detection mechanisms. Recognizing its pivotal role in the APT lifecycle, this paper introduces Cyber Persistence Detector (CPD), a novel system dedicated to detecting cyber persistence through provenance analytics. CPD is founded on the insight that persistent operations typically manifest in two phases: the “persistence setup” and the subsequent “persistence execution”. By causally relating these phases, we enhance our ability to detect persistent threats. First, CPD discerns setups signaling an impending persistent threat and then traces processes linked to remote connections to identify persistence execution activities. A key feature of our system is the introduction ofpseudo-dependency edges(pseudoedges), which effectively connect these disjoint phases using data provenance analysis, andexpert-guided edges, which enable faster tracing and reduced log size. These edges empower us to detect persistence threats accurately and efficiently. Moreover, we propose a novel alert triage algorithm that further reduces false positives associated with persistence threats. Evaluations conducted on well-known datasets demonstrate that our system reduces the average false positive rate by 93% compared to stateof- the-art methods.
@article{liutdsc2026, title = {Accurate and Scalable Detection and Investigation of Cyber Persistence Threats}, author = {Liu, Qi and Shoaib, Muhammad and Rehman, Mati Ur and Bao, Kaibin and Hagenmeyer, Veit and Hassan, Wajih Ul}, journal = {Transactions on Dependable and Secure Computing}, year = {2026}, doi = {10.1109/tdsc.2026.3689905} }
FCCM
RapidScan: High-Throughput Parameterized HLS-based Streaming String Matching Library for FPGAs

Shashank Obla, Tommy Tracy II, Matthew Beck, James C. Hoe, Kevin Skadron, and Wajih Ul Hassan

In IEEE 34th Annual International Symposium on Field-Programmable Custom Computing Machines (FCCM), 2026

Abstract Bib PDF

Prior work in hardware acceleration of regular-expression matching deep-packet inspection has shown orders of magnitude improvement in energy and cost. However, efficiency gains from an RTL implementation lack portability across domains, FPGA platforms and even rulesets or input traffic patterns that demand re-tuning of the streaming input-dependent filtering stages. In this work, we introduce RAPIDSCAN, a novel HLS-based streaming string-matching library that treats parameterizability and development agility as first-class design goals alongside performance and efficiency. Using the streaming computation model, we designed the data-dependent computations of string matching into a library of fully-pipelined HLS kernels. The kernels can be composed into a streaming pipeline at compile time as well as parameterized to tradeoff performance and resources for specific workloads. To demonstrate the library’s efficacy, we showcase its application to log monitoring on the Versal V80 device, adding new kernels essential for processing logs. The resulting system, RAPIDDETECT, achieves a throughput of over 160 Gbps on real-world log inputs using a single server.
@inproceedings{obla2026rapidscan, title = {RapidScan: High-Throughput Parameterized HLS-based Streaming String Matching Library for FPGAs}, author = {Obla, Shashank and Tracy II, Tommy and Beck, Matthew and Hoe, James C. and Skadron, Kevin and Hassan, Wajih Ul}, booktitle = {IEEE 34th Annual International Symposium on Field-Programmable Custom Computing Machines (FCCM)}, year = {2026}, publisher = {IEEE}, doi = {10.1109/FCCM68464.2026.00079}, }

ACM CCS

A First-Principles Evaluation of Graph-Based Network Intrusion Detection Systems

Rui Zhao, and Wajih Ul Hassan

In ACM Conference on Computer and Communications Security (CCS), 2026

@inproceedings{gidseval,
  title = {A First-Principles Evaluation of Graph-Based Network Intrusion Detection Systems},
  author = {Zhao, Rui and Hassan, Wajih Ul},
  booktitle = {ACM Conference on Computer and Communications Security (CCS)},
  year = {2026},
}

2025

Infocom
A Principled Approach for Detecting APTs in Massive Networks via Multi-Stage Causal Analytics

Jiaping Gui, Mingjie Nie, Jinyao Guo, Futai Zou, Mati Ur Rehman, and Wajih Ul Hassan

In IEEE INFOCOM, 2025

Abstract Bib PDF

Detecting Advanced Persistent Threats (APTs) in large enterprise networks with conventional Network Intrusion Detection Systems (NIDS) is challenging due to the stealthy, multi-stage, and long-running nature of APTs. This paper introduces NETGUARDIAN, a novel NIDS utilizing a comprehensive methodology to correlate anomalies across APT stages. By merging real traffic with simulated APT scenarios, NETGUARDIAN creates a detailed training dataset for enhanced anomaly detection. NETGUARDIAN implements custom models for each APT stage, extracting specific traffic features, such as periodicity and failed connections, to identify anomalies. These anomalies are then correlated to reconstruct attack paths. Our system leverages these paths to assign threat scores based on interconnected anomalies matching known APT progression, effectively prioritizing suspicious paths. Evaluation on a large dataset of enterprise network traffic merged with simulated APTs along with the DARPA OpTC dataset shows that NETGUARDIAN detects various APT stages with high accuracy and low false positives, outperforming state-of-the-art (SOTA) NIDS.
@inproceedings{gui2025principled, title = {A Principled Approach for Detecting APTs in Massive Networks via Multi-Stage Causal Analytics}, author = {Gui, Jiaping and Nie, Mingjie and Guo, Jinyao and Zou, Futai and Rehman, Mati Ur and Hassan, Wajih Ul}, booktitle = {IEEE INFOCOM}, year = {2025}, doi = {10.1109/infocom55648.2025.11044565} }
USENIX Security
Principled and Automated Approach for Investigating AR/VR Attacks

Muhammad Shoaib, Alex Suh, and Wajih Ul Hassan

In USENIX Security Symposium, 2025

Abstract Bib PDF

As Augmented and Virtual Reality (AR/VR) adoption grows across sectors, auditing systems are needed to enable provenance analysis of AR/VR attacks. However, traditional auditing systems often generate inaccurate and incomplete provenance graphs, or fail to work due to operational restrictions in AR/VR devices. This paper presents REALITYCHECK, a provenance-based auditing system designed to support accurate root cause analysis and impact assessments of complex AR/VR attacks. Our system first enhances the W3C PROV data model with additional ontology to capture AR/VR-specific entities and causal relationships. Then, we employ a novel adaptation of natural language processing and feature-based log correlation techniques to transparently extract entities and relationships from dispersed, unstructured AR/VR logs into provenance graphs. Finally, we introduce an AR/VR-aware execution partitioning technique to filter out forensically irrelevant data and false causal relationships from these provenance graphs, improving analysis accuracy and investigation speed. We built a REALITYCHECK prototype for Meta Quest 2 and evaluated it against 25 real-world AR/VR attacks. The results show that REALITYCHECK generates accurate provenance graphs for all AR/VR attacks and incurs low runtime overhead across benchmarked applications. Notably, our execution partitioning approach drastically reduces the size of the graph without sacrificing essential investigation details. Our system operates non-intrusively, requires no additional installation, and is generalizable across various AR/VR devices.
@inproceedings{realitycheck, title = {Principled and Automated Approach for Investigating AR/VR Attacks}, author = {Shoaib, Muhammad and Suh, Alex and Hassan, Wajih Ul}, year = {2025}, booktitle = {USENIX Security Symposium}, }
ACM CCS
Rethinking Tamper-Evident Logging: A High-Performance, Co-Designed Auditing System

Rui Zhao, Muhammad Shoaib, Viet Tung Hoang, and Wajih Ul Hassan

In ACM Conference on Computer and Communications Security (CCS), 2025

Abstract Bib PDF 🏅 Distinguished Paper Award

Existing tamper-evident logging systems suffer from high overhead and severe data loss in high-load settings, yet only provide coarse-grained tamper detection. Moreover, installing such systems requires recompiling kernel code. To address these challenges, we present Nitro, a high-performance, tamper-evident audit logging system that supports fine-grained detection of log tampering. Even better, our system avoids kernel recompilation by using the eBPF technology. To formally justify the security of Nitro, we provide a new definitional framework for logging systems, and give a practical cryptographic construction meeting this new goal. Unlike prior work that focus only on the cryptographic processing, we codesign the cryptographic part with the pre- and post-processing of the logs to exploit all system-level optimizations. Our evaluations demonstrate Nitro’s superior performance, achieving 10X-25X improvements in high-stress conditions and 2X-10X in real-world scenarios while maintaining near-zero data loss. We also provide an advanced variant, Nitro-R that introduces in-kernel log reduction techniques to reduce runtime overhead even further.
@inproceedings{nitro, title = {Rethinking Tamper-Evident Logging: A High-Performance, Co-Designed Auditing System}, author = {Zhao, Rui and Shoaib, Muhammad and Hoang, Viet Tung and Hassan, Wajih Ul}, booktitle = {ACM Conference on Computer and Communications Security (CCS)}, year = {2025}, doi = {10.1145/3719027.3765024} }
TDSC
HADES: Detecting Active Directory Attacks via Whole Network Provenance Analytics

Qi Liu, Kaibin Bao, Wajih Ul Hassan, and Veit Hagenmeyer

IEEE Transactions on Dependable and Secure Computing, 2025

Abstract Bib PDF

Due to its crucial role in identity and access management in modern enterprise networks, Active Directory (AD) is a top target of Advanced Persistence Threat (APT) actors. Conventional intrusion detection systems (IDS) excel at identifying malicious behaviors caused by malware, but often fail to detect stealthy attacks launched by APT actors. Recent advance in provenance-based IDS (PIDS) shows promises by exposing malicious system activities in causal attack graphs. However, existing approaches are restricted to intra-machine tracing, and unable to reveal the scope of attackers’ traversal inside a network. We proposeHADES, the first PIDS capable of performing accurate causality-based cross-machine tracing by leveraging a novel concept calledlogon session based execution partitioningto overcome several challenges in cross-machine tracing. We designHADESas an efficient on-demand tracing system, which performs whole-network tracing only when it first identifies an authentication anomaly signifying an ongoing AD attack, for which we introduce a novel lightweight authentication anomaly detection model rooted in our extensive analysis of AD attacks. To triage attack alerts, we present a new algorithm integrating two key insights we identified in AD attacks. Our evaluations show thatHADESoutperforms both popular open-source detection systems and a prominent commercial AD attack detector.
@article{liu2025hades, title = {HADES: Detecting Active Directory Attacks via Whole Network Provenance Analytics}, author = {Liu, Qi and Bao, Kaibin and Hassan, Wajih Ul and Hagenmeyer, Veit}, journal = {IEEE Transactions on Dependable and Secure Computing}, year = {2025}, doi = {10.1109/tdsc.2025.3611866} }
ACSAC
R+R: From Claims to Crashes: A Systematic Re-evaluation of Graph-Based Network Intrusion Detection Systems

Chenglong Wang, Pujia Zheng, Jiaping Gui, Cunqing Hua, and Wajih Ul Hassan

In Annual Computer Security Applications Conference (ACSAC), 2025

Abstract Bib PDF

Graph-based Network Intrusion Detection Systems (GIDS) are increasingly used to model complex communication patterns and detect sophisticated enterprise threats, yet the reproducibility and replicability of GIDS research remain underexplored, limiting the reliability and generalizability of published results. We present a rigorous reproduction and replication of five state-of-the-art GIDS across four public datasets and a new large-scale enterprise dataset. Even with original code and configurations, reproducing claimed performance is difficult; detection metrics vary by up to 40 percent due to undocumented assumptions, preprocessing discrepancies, and hyperparameter sensitivity. Models also fail to generalize to real-world enterprise traffic, exhibiting high false positive rates and scalability issues. We identify key implementation factors: graph snapshot size and threshold-setting strategies significantly affect detection performance but are inconsistently documented, and several GIDS are vulnerable to evasion attacks. Beyond confirming known challenges (e.g., parameter sensitivity), our results expose a critical reproducibility crisis in the GIDS literature: without transparent and systematic evaluation, reported results may mislead researchers and practitioners. We provide recommendations to improve reproducibility, replicability, and robustness, and urge the community to adopt rigorous standards for empirical evaluation.
@inproceedings{wang2025rr, title = {{R+R}: From Claims to Crashes: A Systematic Re-evaluation of Graph-Based Network Intrusion Detection Systems}, author = {Wang, Chenglong and Zheng, Pujia and Gui, Jiaping and Hua, Cunqing and Hassan, Wajih Ul}, booktitle = {Annual Computer Security Applications Conference (ACSAC)}, year = {2025}, doi = {10.1109/acsac67867.2025.00050} }
MobiHoc
Demo: Investigating Immersive Attacks with REALITYCHECK

Muhammad Shoaib, and Wajih Ul Hassan

In First Workshop on Enhancing Security, Privacy, and Trust in Extended Reality (XR) Systems, 2025

Abstract Bib PDF

RealityCheck, recently published at USENIX Security 2025, is the first provenance-based auditing framework that enables comprehensive root-cause and impact analysis of complex attacks against Augmented/Virtual-Reality (AR/VR) head-mounted devices. This demonstration paper describes the live, hands-on instantiation of RealityCheck, highlighting how security analysts can transparently capture multi-layer logs from commodity headsets, automatically transform these heterogeneous traces into concise multilayer provenance graphs, and perform real-time exploratory queries to isolate attack causality. We demonstrate RealityCheck reconstructing an end-to-end provenance graph for the Object-in-the-middle attack, published at USENIX Security 2024, on a Meta Quest 2, achieving millisecond-level query latency with negligible runtime overhead.
@inproceedings{demo-realitycheck, author = {Shoaib, Muhammad and Hassan, Wajih Ul}, title = {Demo: Investigating Immersive Attacks with REALITYCHECK}, year = {2025}, booktitle = {First Workshop on Enhancing Security, Privacy, and Trust in Extended Reality (XR) Systems}, doi = {10.1145/3704413.3765306} }

2024

Oakland
FLASH: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning

Mati Ur Rehman, Hadi Ahmadi, and Wajih Ul Hassan

In IEEE Symposium on Security and Privacy (S&P), 2024

Abstract Bib PDF

Recently, provenance-based Intrusion Detection Systems (IDSes) have gained popularity for their potential in detecting sophisticated Advanced Persistent Threat (APT) attacks. These IDSes employ provenance graphs created from system logs to identify potentially malicious activities. Despite their potential, they face challenges in accuracy, practicality, and scalability, particularly when dealing with large provenance graphs. We present Flash, a scalable IDS that leverages graph representation learning through Graph Neural Networks (GNNs) on data provenance graphs to overcome these limitations. Flash employs a Word2Vec-based semantic encoder to capture essential semantic attributes (e.g., process names and file paths) and the temporal ordering of events within the provenance graph. Furthermore, Flash incorporates a novel adaptation of a GNN-based contextual encoder to efficiently encode both local and global graph structures into expressive node embeddings. To learn benign node behaviors, we utilize a lightweight classifier that combines the GNN and Word2Vec embeddings. Recognizing the computational demands and slow processing times of GNN, particularly for large provenance graphs, we have developed an embedding recycling database to store the node embeddings generated during the training phase. During runtime, our lightweight classifier leverages the stored embeddings, obviating the need to regenerate GNN embeddings, thus facilitating real-time APT detection. Extensive evaluation of Flash on real-world datasets demonstrates superior detection accuracy compared to existing provenance-based IDSes. The results also illustrate Flash’s scalability, robustness against mimicry attacks, and potential for accelerating the alert verification process.
@inproceedings{flash2024, title = {FLASH: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning}, author = {Rehman, Mati Ur and Ahmadi, Hadi and Hassan, Wajih Ul}, booktitle = {IEEE Symposium on Security and Privacy (S\&P)}, year = {2024}, doi = {10.1109/sp54263.2024.00139} }
arXiv
Accurate and Scalable Detection and Investigation of Cyber Persistence Threats

Qi Liu, Muhammad Shoaib, Mati Ur Rehman, Kaibin Bao, Veit Hagenmeyer, and Wajih Ul Hassan

arXiv preprint arXiv:2407.18832, 2024

Abstract Bib PDF

In Advanced Persistent Threat (APT) attacks, achieving stealthy persistence within target systems is often crucial for an attacker’s success. This persistence allows adversaries to maintain prolonged access, often evading detection mechanisms. Recognizing its pivotal role in the APT lifecycle, this paper introduces Cyber Persistence Detector (CPD), a novel system dedicated to detecting cyber persistence through provenance analytics. CPD is founded on the insight that persistent operations typically manifest in two phases: the "persistence setup" and the subsequent "persistence execution". By causally relating these phases, we enhance our ability to detect persistent threats. First, CPD discerns setups signaling an impending persistent threat and then traces processes linked to remote connections to identify persistence execution activities. A key feature of our system is the introduction of pseudo-dependency edges (pseudo-edges), which effectively connect these disjoint phases using data provenance analysis, and expert-guided edges, which enable faster tracing and reduced log size. These edges empower us to detect persistence threats accurately and efficiently. Moreover, we propose a novel alert triage algorithm that further reduces false positives associated with persistence threats. Evaluations conducted on well-known datasets demonstrate that our system reduces the average false positive rate by 93% compared to state-of-the-art methods.
@article{liu2024accurate, title = {Accurate and Scalable Detection and Investigation of Cyber Persistence Threats}, author = {Liu, Qi and Shoaib, Muhammad and Rehman, Mati Ur and Bao, Kaibin and Hagenmeyer, Veit and Hassan, Wajih Ul}, journal = {arXiv preprint arXiv:2407.18832}, year = {2024}, doi = {10.48550/arXiv.2407.18832} }

2023

Oakland
SoK: History is a Vast Early Warning System: Auditing the Provenance of System Intrusions

Muhammad Adil Inam, Yinfang Chen, Akul Goyal, Jason Liu, Jaron Mink, Noor Michael, Sneha Gaur, Adam Bates, and 1 more author

In IEEE Symposium on Security and Privacy (S&P), 2023

Abstract Bib PDF

Auditing, a central pillar of operating system security, has only recently come into its own as an active area of public research. This resurgent interest is due in large part to the notion of data provenance, a technique that iteratively parses audit log entries into a dependency graph that explains the history of system execution. Provenance facilitates precise threat detection and investigation through causal analysis of sophisticated intrusion behaviors. However, the absence of a foundational audit literature, combined with the rapid publication of recent findings, makes it difficult to gain a holistic picture of advancements and open challenges in the area. In this work, we survey and categorize the provenance-based system auditing literature, distilling contributions into a layered taxonomy based on the audit log capture and analysis pipeline. Recognizing that the Reduction Layer remains a key obstacle to the further proliferation of causal analysis technologies, we delve further on this issue by conducting an ambitious independent evaluation of 8 exemplar reduction techniques against the recently-released DARPA Transparent Computing datasets. Our experiments uncover that past approaches frequently prune an overlapping set of activities from audit logs, reducing the synergistic benefits from applying them in tandem; further, we observe an inverse relation between storage efficiency and anomaly detection performance. However, we also observe that log reduction techniques are able to synergize effectively with data compression, potentially reducing log retention costs by multiple orders of magnitude. We conclude by discussing promising future directions for the field.
@inproceedings{inam2022sok, title = {SoK: History is a Vast Early Warning System: Auditing the Provenance of System Intrusions}, author = {Inam, Muhammad Adil and Chen, Yinfang and Goyal, Akul and Liu, Jason and Mink, Jaron and Michael, Noor and Gaur, Sneha and Bates, Adam and Hassan, Wajih Ul}, booktitle = {IEEE Symposium on Security and Privacy (S\&P)}, year = {2023}, doi = {10.1109/sp46215.2023.10179405} }

2022

NDSS
Forensic Analysis of Configuration-based Attacks

Muhammad Adil Inam, Wajih Ul Hassan, Ali Ahad, Adam Bates, Rashid Tahir, Tianyin Xu, and Fareed Zaffar

In Symposium on Network and Distributed System Security (NDSS), 2022

Abstract Bib PDF

Causality analysis is an effective technique for investigating and detecting cyber attacks. However, by focusing on auditing at the Operating System level, existing causal analysis techniques lack visibility into important application-level semantics, such as configuration changes that control application runtime behavior. This leads to incorrect attack attribution and half-baked tracebacks.
@inproceedings{dossier, title = {Forensic Analysis of Configuration-based Attacks}, author = {Inam, Muhammad Adil and Hassan, Wajih Ul and Ahad, Ali and Bates, Adam and Tahir, Rashid and Xu, Tianyin and Zaffar, Fareed}, year = {2022}, booktitle = {Symposium on Network and Distributed System Security (NDSS)}, doi = {10.14722/ndss.2022.23057} }
ACSAC
FAuST: Striking a Bargain between Forensic Auditing’s Security and Throughput

Muhammad Adil Inam, Akul Goyal, Jason Liu, Jaron Mink, Noor Michael, Sneha Gaur, Adam Bates, and Wajih Ul Hassan

In Annual Computer Security Applications Conference (ACSAC), 2022

Abstract Bib PDF

System logs are invaluable to forensic audits, but grow so large that in practice fine-grained logs are quickly discarded - if captured at all - preventing the real-world use of the provenance-based investigation techniques that have gained popularity in the literature. Encouragingly, forensically-informed methods for reducing the size of system logs are a subject of frequent study. Unfortunately, many of these techniques are designed for offline reduction in a central server, meaning that the up-front cost of log capture, storage, and transmission must still be paid at the endpoints. Moreover, to date these techniques exist as isolated (and, often, closed-source) implementations; there does not exist a comprehensive framework through which the combined benefits of multiple log reduction techniques can be enjoyed. In this work, we present FAuST, an audit daemon for performing streaming audit log reduction at system endpoints. After registering with a log source (e.g., via Linux Audit’s audisp utility), FAuST incrementally builds an in-memory provenance graph of recent system activity. During graph construction, log reduction techniques that can be applied to local subgraphs are invoked immediately us-ing event callback handlers, while techniques meant for application on the global graph are invoked in periodic epochs. We evaluate FAuST, loaded with eight different log reduction modules from the literature, against the DARPA Transparent Computing datasets. Our experiments demonstrate the efficient performance of FAuST and identify certain subsets of reduction techniques that are synergistic with one another. Thus, FAuST dramatically simplifies the evaluation and deployment of log reduction techniques.
@inproceedings{inam2022faust, title = {FAuST: Striking a Bargain between Forensic Auditing's Security and Throughput}, author = {Inam, Muhammad Adil and Goyal, Akul and Liu, Jason and Mink, Jaron and Michael, Noor and Gaur, Sneha and Bates, Adam and Hassan, Wajih Ul}, booktitle = {Annual Computer Security Applications Conference (ACSAC)}, year = {2022}, doi = {10.1145/3564625.3567990} }

2021

CCS
Validating the Integrity of Audit Logs Against Execution Repartitioning Attacks

Carter Yagemann, Mohammad Noureddine, Wajih Ul Hassan, Simon Chung, Adam Bates, and Wenke Lee

In ACM Conference on Computer and Communications Security (CCS), 2021

Abstract Bib PDF

Provenance-based causal analysis of audit logs has proven to be an invaluable method of investigating system intrusions. However, it also suffers from dependency explosion, whereby long-running processes accumulate many dependencies that are hard to unravel. Execution unit partitioning addresses this by segmenting dependencies into units of work, such as isolating the events that processed a single HTTP request. Unfortunately, we discover that current designs have a semantic gap problem due to how system calls and application log messages are used to infer complex internal program states. We demonstrate how attackers can modify existing code exploits to control event partitioning, breaking links in the attack and framing innocent users. We also show how our techniques circumvent existing program and log integrity defenses.
@inproceedings{yagemann2021validating, title = {Validating the Integrity of Audit Logs Against Execution Repartitioning Attacks}, author = {Yagemann, Carter and Noureddine, Mohammad and Hassan, Wajih Ul and Chung, Simon and Bates, Adam and Lee, Wenke}, year = {2021}, booktitle = {ACM Conference on Computer and Communications Security (CCS)}, doi = {10.1145/3460120.3484551} }

2020

NDSS
You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis.

Qi Wang, Wajih Ul Hassan, Ding Li, Kangkook Jee, Xiao Yu, Kexuan Zou, Junghwan Rhee, Zhengzhang Chen, and 3 more authors

In Symposium on Network and Distributed System Security (NDSS), 2020

Abstract Bib PDF

To subvert recent advances in perimeter and host security, the attacker community has developed and employed various attack vectors to make a malware much stealthier than before to penetrate the target system and prolong its presence. Such advanced malware or "stealthy malware" makes use of various techniques to impersonate or abuse benign applications and legitimate system tools to minimize its footprints in the target system. It is thus difficult for traditional detection tools, such as malware scanners, to detect it, as the malware normally does not expose its malicious payload in a file and hides its malicious behaviors among the benign behaviors of the processes. In this paper, we present PROVDETECTOR, a provenancebased approach for detecting stealthy malware. Our insight behind the PROVDETECTOR approach is that although a stealthy malware attempts to blend into benign processes, its malicious behaviors inevitably interact with the underlying operating system (OS), which will be exposed to and captured by provenance monitoring. Based on this intuition, PROVDETECTOR first employs a novel selection algorithm to identify possibly malicious parts in the OS-level provenance data of a process. It then applies a neural embedding and machine learning pipeline to automatically detect any behavior that deviates significantly from normal behaviors. We evaluate our approach on a large provenance dataset from an enterprise network and demonstrate that it achieves very high detection performance of stealthy malware (an average F1 score of 0.974).Further, we conduct thorough interpretability studies to understand the internals of the learned machine learning models.
@inproceedings{provdetector2020, title = {You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis.}, author = {Wang, Qi and Hassan, Wajih Ul and Li, Ding and Jee, Kangkook and Yu, Xiao and Zou, Kexuan and Rhee, Junghwan and Chen, Zhengzhang and Cheng, Wei and Gunter, Carl A and Chen, Haifeng}, year = {2020}, booktitle = {Symposium on Network and Distributed System Security (NDSS)}, doi = {10.14722/ndss.2020.24167} }
Oakland
Tactical Provenance Analysis for Endpoint Detection and Response Systems

Wajih Ul Hassan, Adam Bates, and Daniel Marino

In IEEE Symposium on Security and Privacy (S&P), 2020

Abstract Bib PDF

Endpoint Detection and Response (EDR) tools provide visibility into sophisticated intrusions by matching system events against known adversarial behaviors. However, current solutions suffer from three challenges: 1) EDR tools generate a high volume of false alarms, creating backlogs of investigation tasks for analysts; 2) determining the veracity of these threat alerts requires tedious manual labor due to the overwhelming amount of low-level system logs, creating a "needle-in-a-haystack" problem; and 3) due to the tremendous resource burden of log retention, in practice the system logs describing long-lived attack campaigns are often deleted before an investigation is ever initiated. This paper describes an effort to bring the benefits of data provenance to commercial EDR tools. We introduce the notion of Tactical Provenance Graphs (TPGs) that, rather than encoding low-level system event dependencies, reason about causal dependencies between EDR-generated threat alerts. TPGs provide compact visualization of multi-stage attacks to analysts, accelerating investigation. To address EDR’s false alarm problem, we introduce a threat scoring methodology that assesses risk based on the temporal ordering between individual threat alerts present in the TPG. In contrast to the retention of unwieldy system logs, we maintain a minimally-sufficient skeleton graph that can provide linkability between existing and future threat alerts. We evaluate our system, RapSheet, using the Symantec EDR tool in an enterprise environment. Results show that our approach can rank truly malicious TPGs higher than false alarm TPGs. Moreover, our skeleton graph reduces the long-term burden of log retention by up to 87%.
@inproceedings{rapsheet2020, title = {Tactical Provenance Analysis for Endpoint Detection and Response Systems}, author = {Hassan, Wajih Ul and Bates, Adam and Marino, Daniel}, year = {2020}, booktitle = {IEEE Symposium on Security and Privacy (S\&P)}, doi = {10.1109/sp40000.2020.00096} }
NDSS
OmegaLog: High-Fidelity Attack Investigation via Transparent Multi-layer Log Analysis

Wajih Ul Hassan, Mohammad A Noureddine, Pubali Datta, and Adam Bates

In Symposium on Network and Distributed System Security (NDSS), 2020

Abstract Bib PDF

Recent advances in causality analysis have enabled investigators to trace multi-stage attacks using provenance graphs. Based on system-layer audit logs (e.g., syscalls), these approaches omit vital sources of application context (e.g., email addresses, HTTP response codes) that can be found in higher layers of the system. Although such information is often essential to understanding attack behaviors, it is difficult to incorporate this evidence into causal analysis engines because of the semantic gap that exists between system layers. To address that shortcoming, we propose the notion of universal provenance, which encodes all forensically relevant causal dependencies regardless of their layer of origin. To transparently realize that vision on commodity systems, we present OmegaLog, a provenance tracker that bridges the semantic gap between system and application logging contexts. OmegaLog analyzes program binaries to identify and model application-layer logging behaviors, enabling accurate reconciliation of application events with system-layer accesses. OmegaLog then intercepts applications’ runtime logging activities and grafts those events onto the system-layer provenance graph, allowing investigators to reason more precisely about the nature of attacks. We demonstrate that our system is widely applicable to existing software projects and can transparently facilitate execution partitioning of provenance graphs without any training or developer intervention. Evaluation on real-world attack scenarios shows that our technique generates concise provenance graphs with rich semantic information relative to the state-of-the-art, with an average runtime overhead of 4%.
@inproceedings{omegalog2020, title = {{OmegaLog}: High-Fidelity Attack Investigation via Transparent Multi-layer Log Analysis}, author = {Hassan, Wajih Ul and Noureddine, Mohammad A and Datta, Pubali and Bates, Adam}, year = {2020}, booktitle = {Symposium on Network and Distributed System Security (NDSS)}, doi = {10.14722/ndss.2020.24270} }
ACSAC
This is Why We Can’t Cache Nice Things: Lightning-Fast Threat Hunting using Suspicion-Based Hierarchical Storage

Wajih Ul Hassan, Ding Li, Kangkook Jee, Xiao Yu, Kexuan Zou, Dawei Wang, Zhengzhang Chen, Zhichun Li, and 3 more authors

In Annual Computer Security Applications Conference (ACSAC), 2020

Abstract Bib PDF

Recent advances in the causal analysis can accelerate incident response time, but only after a causal graph of the attack has been constructed. Unfortunately, existing causal graph generation techniques are mainly offline and may take hours or days to respond to investigator queries, creating greater opportunity for attackers to hide their attack footprint, gain persistency, and propagate to other machines. To address that limitation, we present Swift, a threat investigation system that provides high-throughput causality track-ing and real-time causal graph generation capabilities. We design an in-memory graph database that enables space-efficient graph storage and online causality tracking with minimal disk operations. We propose a hierarchical storage system that keeps forensically-relevant part of the causal graph in main memory while evicting rest to disk. To identify the causal graph that is likely to be relevant during the investigation, we design an asynchronous cache eviction policy that calculates the most suspicious part of the causal graph and caches only that part in the main memory. We evaluated Swift on a real-world enterprise to demonstrate how our system scales to process typical event loads and how it responds to forensic queries when security alerts occur. Results show that Swift is scalable, modular, and answers forensic queries in real-time even when analyzing audit logs containing tens of millions of events.
@inproceedings{swift2020, title = {This is Why We Can't Cache Nice Things: Lightning-Fast Threat Hunting using Suspicion-Based Hierarchical Storage}, author = {Hassan, Wajih Ul and Li, Ding and Jee, Kangkook and Yu, Xiao and Zou, Kexuan and Wang, Dawei and Chen, Zhengzhang and Li, Zhichun and Rhee, Junghwan and Gui, Jiaping and Bates, Adam}, year = {2020}, booktitle = {Annual Computer Security Applications Conference (ACSAC)}, doi = {10.1145/3427228.3427255} }
ACSAC
On the Forensic Validity of Approximated Audit Logs

Noor Michael, Jaron Mink, Jason Liu, Sneha Gaur, Wajih Ul Hassan, and Adam Bates

In Annual Computer Security Applications Conference (ACSAC), 2020

Abstract Bib PDF

Auditing is an increasingly essential tool for the defense of computing systems, but the unwieldy nature of log data imposes significant burdens on administrators and analysts. To address this issue, a variety of techniques have been proposed for approximating the contents of raw audit logs, facilitating efficient storage and analysis. However, the security value of these approximated logs is difficult to measure—relative to the original log, it is unclear if these techniques retain the forensic evidence needed to effectively investigate threats. Unfortunately, prior work has only investigated this issue anecdotally, demonstrating sufficient evidence is retained for specific attack scenarios.
@inproceedings{approx, title = {On the Forensic Validity of Approximated Audit Logs}, author = {Michael, Noor and Mink, Jaron and Liu, Jason and Gaur, Sneha and Hassan, Wajih Ul and Bates, Adam}, year = {2020}, booktitle = {Annual Computer Security Applications Conference (ACSAC)}, doi = {10.1145/3427228.3427272} }
NDSS
Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution

Riccardo Paccagnella, Pubali Datta, Wajih Ul Hassan, Adam Bates, Christopher W. Fletcher, Andrew Miller, and Dave Tian

In Symposium on Network and Distributed System Security (NDSS), 2020

Abstract Bib PDF

System auditing is a central concern when investigating and responding to security incidents. Unfortunately, attackers regularly engage in anti-forensic activities after a breakin, covering their tracks from the system logs in order to frustrate the efforts of investigators. While a variety of tamper-evident logging solutions have appeared throughout the industry and the literature, these techniques do not meet the operational and scalability requirements of system-layer audit frameworks. In this work, we introduce CUSTOS, a practical framework for the detection of tampering in system logs. CUSTOS consists of a tamper-evident logging layer and a decentralized auditing protocol. The former enables the verification of log integrity with minimal changes to the underlying logging framework, while the latter enables near real-time detection of log integrity violations within an enterprise-class network. CUSTOS is made practical by the observation that we can decouple the costs of cryptographic log commitments from the act of creating and storing log events, without trading off security, leveraging features of off-the-shelf trusted execution environments. Supporting over one million events per second, we show that CUSTOS’ tamper-evident logging protocol is three orders of magnitude (1000×) faster than prior solutions and incurs only between 2% and 7% runtime overhead over insecure logging on intensive workloads. Further, we show that CUSTOS’ auditing protocol can detect violations in near realtime even in the presence of a powerful distributed adversary and with minimal (3%) network overhead. Our case study on a real-world APT attack scenario demonstrates that CUSTOS forces anti-forensic attackers into a "lose-lose" situation, where they can either be covert and not tamper with logs (which can be used for forensics), or erase logs but then be detected by CUSTOS.
@inproceedings{custos, title = {{Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution}}, author = {Paccagnella, Riccardo and Datta, Pubali and Hassan, Wajih Ul and Bates, Adam and Fletcher, Christopher W. and Miller, Andrew and Tian, Dave}, year = {2020}, booktitle = {Symposium on Network and Distributed System Security (NDSS)}, doi = {10.14722/ndss.2020.24065} }

2019

Oakland
Can data provenance put an end to the data breach?

Adam Bates, and Wajih Ul Hassan

IEEE Symposium on Security and Privacy (S&P), 2019

Abstract Bib PDF

In September 2017, the world awoke to the news that Equifax, a consumer reporting agency and one of the pillars of the American credit system, fell prey to a data breach that led to the exposure of 147 million individuals’ personal information. For Equifax, the coming weeks would include high-profile executive resignations, a steep drop in its stock prices, and an infamously ill-conceived public outreach effort; however, eventually the public’s attention turned elsewhere. After all, Equifax was just the latest in a seemingly endless parade of data breach victims that included commercial titans like Target and eBay, political campaigns like Hillary Clinton’s, and government agencies like the Office of Personnel Management. Today, the threat of the next data breach looms invisibly over every aspect of society.
@article{magazine2019, title = {Can data provenance put an end to the data breach?}, author = {Bates, Adam and Hassan, Wajih Ul}, year = {2019}, journal = {IEEE Symposium on Security and Privacy (S\&P)}, volume = {17}, doi = {10.1109/msec.2019.2913693} }
NDSS
NoDoze: Combatting threat alert fatigue with automated provenance triage

Wajih Ul Hassan, Shengjian Guo, Ding Li, Zhengzhang Chen, Kangkook Jee, Zhichun Li, and Adam Bates

In Symposium on Network and Distributed System Security (NDSS), 2019

Abstract Bib PDF

Large enterprises are increasingly relying on threat detection softwares (e.g., Intrusion Detection Systems) to allow them to spot suspicious activities. These softwares generate alerts which must be investigated by cyber analysts to figure out if they are true attacks. Unfortunately, in practice, there are more alerts than cyber analysts can properly investigate. This leads to a "threat alert fatigue" or information overload problem where cyber analysts miss true attack alerts in the noise of false alarms. In this paper, we present NODOZE to combat this challenge using contextual and historical information of generated threat alert. NODOZE first generates a causal dependency graph of an alert event. Then, it assigns an anomaly score to each edge in the dependency graph based on the frequency with which related events have happened before in the enterprise. NODOZE then propagates those scores along the neighboring edges of the graph using a novel network diffusion algorithm and generates an aggregate anomaly score which is used for triaging. We deployed and evaluated NODOZE at NEC Labs America. Evaluation on our dataset of 364 threat alerts shows that NODOZE consistently ranked the true alerts higher than the false alerts based on aggregate anomaly scores. Further, through the introduction of a cutoff threshold for anomaly scores, we estimate that our system decreases the volume of false alarms by 84%, saving analysts’ more than 90 hours of investigation time per week. NODOZE generates alert dependency graphs that are two orders of magnitude smaller than those generated by traditional tools without sacrificing the vital information needed for the investigation. Our system has a low average runtime overhead and can be deployed with any threat detection software.
@inproceedings{nodoze2019, title = {{NoDoze}: Combatting threat alert fatigue with automated provenance triage}, author = {Hassan, Wajih Ul and Guo, Shengjian and Li, Ding and Chen, Zhengzhang and Jee, Kangkook and Li, Zhichun and Bates, Adam}, year = {2019}, booktitle = {Symposium on Network and Distributed System Security (NDSS)}, doi = {10.14722/ndss.2019.23349} }

ASE

How effective are existing Java API specifications for finding bugs during runtime verification?

Owolabi Legunsen, Nader Al Awar, Xinyue Xu, Wajih Ul Hassan, Grigore Roşu, and Darko Marinov

Automated Software Engineering, 2019

Bib

@article{legunsen2019effective,
  title = {How effective are existing Java API specifications for finding bugs during runtime verification?},
  author = {Legunsen, Owolabi and Al Awar, Nader and Xu, Xinyue and Hassan, Wajih Ul and Ro{\c{s}}u, Grigore and Marinov, Darko},
  journal = {Automated Software Engineering},
  volume = {26},
  number = {4},
  pages = {795--837},
  year = {2019},
  publisher = {Springer},
  doi = {10.1007/s10515-019-00267-1}
}

2018

NDSS
Towards scalable cluster auditing through grammatical inference over provenance graphs

Wajih Ul Hassan, Mark Lemay, Nuraini Aguse, Adam Bates, and Thomas Moyer

In Symposium on Network and Distributed System Security (NDSS), 2018

Abstract Bib PDF

Investigating the nature of system intrusions in large distributed systems remains a notoriously difficult challenge. While monitoring tools (e.g., Firewalls, IDS) provide preliminary alerts through easy-to-use administrative interfaces, attack reconstruction still requires that administrators sift through gigabytes of system audit logs stored locally on hundreds of machines. At present, two fundamental obstacles prevent synergy between system-layer auditing and modern cluster monitoring tools: 1) the sheer volume of audit data generated in a data center is prohibitively costly to transmit to a central node, and 2) systemlayer auditing poses a "needle-in-a-haystack" problem, such that hundreds of employee hours may be required to diagnose a single intrusion. This paper presents Winnower, a scalable system for auditbased cluster monitoring that addresses these challenges. Our key insight is that, for tasks that are replicated across nodes in a distributed application, a model can be defined over audit logs to succinctly summarize the behavior of many nodes, thus eliminating the need to transmit redundant audit records to a central monitoring node. Specifically, Winnower parses audit records into provenance graphs that describe the actions of individual nodes, then performs grammatical inference over individual graphs using a novel adaptation of Deterministic Finite Automata (DFA) Learning to produce a behavioral model of many nodes at once. This provenance model can be efficiently transmitted to a central node and used to identify anomalous events in the cluster. We have implemented Winnower for Docker Swarm container clusters and evaluate our system against real-world applications and attacks. We show that Winnower dramatically reduces storage and network overhead associated with aggregating system audit logs, by as much as 98%, without sacrificing the important information needed for attack investigation. Winnower thus represents a significant step forward for security monitoring in distributed systems.
@inproceedings{winnower2018, title = {Towards scalable cluster auditing through grammatical inference over provenance graphs}, author = {Hassan, Wajih Ul and Lemay, Mark and Aguse, Nuraini and Bates, Adam and Moyer, Thomas}, year = {2018}, booktitle = {Symposium on Network and Distributed System Security (NDSS)}, doi = {10.14722/ndss.2018.23141} }
NDSS
Fear and Logging in the Internet of Things

Qi Wang, Wajih Ul Hassan, Adam Bates, and Carl Gunter

In Symposium on Network and Distributed System Security (NDSS), 2018

Abstract Bib PDF

As the Internet of Things (IoT) continues to proliferate, diagnosing incorrect behavior within increasinglyautomated homes becomes considerably more difficult. Devices and apps may be chained together in long sequences of triggeraction rules to the point that from an observable symptom (e.g., an unlocked door) it may be impossible to identify the distantly removed root cause (e.g., a malicious app).This is because, at present, IoT audit logs are siloed on individual devices, and hence cannot be used to reconstruct the causal relationships of complex workflows. In this work, we present ProvThings, a platform-centric approach to centralized auditing in the Internet of Things. ProvThings performs efficient automated instrumentation of IoT apps and device APIs in order to generate data provenance that provides a holistic explanation of system activities, including malicious behaviors. We prototype ProvThings for the Samsung SmartThings platform, and benchmark the efficacy of our approach against a corpus of 26 IoT attacks. Through the introduction of a selective code instrumentation optimization, we demonstrate in evaluation that ProvThings imposes just 5% overhead on physical IoT devices while enabling real time querying of system behaviors, and further consider how ProvThings can be leveraged to meet the needs of a variety of stakeholders in the IoT ecosystem.
@inproceedings{provthings2018, title = {Fear and Logging in the Internet of Things}, author = {Wang, Qi and Hassan, Wajih Ul and Bates, Adam and Gunter, Carl}, year = {2018}, booktitle = {Symposium on Network and Distributed System Security (NDSS)}, doi = {10.14722/ndss.2018.23282} }
USENIX Security
Analysis of privacy protections in fitness tracking social networks-or-you can run, but can you hide?

Wajih Ul Hassan, Saad Hussain, and Adam Bates

In USENIX Security Symposium, 2018

Abstract Bib PDF

Mobile fitness tracking apps allow users to track their workouts and share them with friends through online social networks. Although the sharing of personal data is an inherent risk in all social networks, the dangers presented by sharing personal workouts comprised of geospatial and health data may prove especially grave. While fitness apps offer a variety of privacy features, at present it is unclear if these countermeasures are sufficient to thwart a determined attacker, nor is it clear how many of these services’ users are at risk. In this work, we perform a systematic analysis of privacy behaviors and threats in fitness tracking social networks. Collecting a month-long snapshot of public posts of a popular fitness tracking service (21 million posts, 3 million users), we observe that 16.5% of users make use of Endpoint Privacy Zones (EPZs), which conceal fitness activity near user-designated sensitive lo-cations (e.g., home, office). We go on to develop an attack against EPZs that infers users’ protected locations from the remaining available information in public posts, discovering that 95.1% of moderately active users are at risk of having their protected locations extracted by an attacker. Finally, we consider the efficacy of state-of-the-art privacy mechanisms through adapting geo-indistinguishability techniques as well as developing a novel EPZ fuzzing technique. The affected companies have been notified of the discovered vulnerabilities and at the time of publication have incorporated our proposed countermeasures into their production systems.
@inproceedings{hassan2018analysis, title = {Analysis of privacy protections in fitness tracking social networks-or-you can run, but can you hide?}, author = {Hassan, Wajih Ul and Hussain, Saad and Bates, Adam}, booktitle = {USENIX Security Symposium}, pages = {497--512}, year = {2018}, }

2017

TaPP
Automated provenance analytics: A regular grammar based approach with applications in security

Mark Lemay, Wajih Ul Hassan, Thomas Moyer, Nabil Schear, and Warren Smith

In 9th USENIX Workshop on the Theory and Practice of Provenance (TaPP 2017), 2017

Abstract Bib PDF

Provenance collection techniques have been carefully studied in the literature, and there are now several systems to automatically capture provenance data. However, the analysis of provenance data is often left "as an exercise for the reader". The provenance community needs tools that allow users to quickly sort through large volumes of provenance data and identify records that require further investigation. By detecting anomalies in provenance data that deviate from established patterns, we hope to actively thwart security threats. In this paper, we discuss issues with current graph analysis techniques as applied to data provenance, particularly Frequent Subgraph Mining (FSM). Then we introduce Directed Acyclic Graph regular grammars (DAGr) as a model for provenance data and show how they can detect anomalies. These DAGr provide an expressive characterization of DAGs, and by using regular grammars as a formalism, we can apply results from formal language theory to learn the difference between "good" and "bad" provenance. We propose a restricted subclass of DAGr called deterministic Directed Acyclic Graph automata (dDAGa) that guarantees parsing in linear time. Finally, we propose a learning algorithm for dDAGa, inspired by Minimum Description Length for Grammar Induction [1].
@inproceedings{lemay2017automated, title = {Automated provenance analytics: A regular grammar based approach with applications in security}, author = {Lemay, Mark and Hassan, Wajih Ul and Moyer, Thomas and Schear, Nabil and Smith, Warren}, booktitle = {9th USENIX Workshop on the Theory and Practice of Provenance (TaPP 2017)}, year = {2017}, }
WWW
Transparent web service auditing via network provenance functions

Adam Bates, Wajih Ul Hassan, Kevin Butler, Alin Dobra, Bradley Reaves, Patrick Cable, Thomas Moyer, and Nabil Schear

In International World Wide Web Conference (WWW), 2017

Abstract Bib PDF

Detecting and explaining the nature of attacks in distributed web services is often difficult – determining the nature of suspicious activity requires following the trail of an attacker through a chain of heterogeneous software components including load balancers, proxies, worker nodes, and storage services. Unfortunately, existing forensic solutions cannot provide the necessary context to link events across complex workflows, particularly in instances where application layer semantics (e.g., SQL queries, RPCs) are needed to understand the attack. In this work, we present a transparent provenance-based approach for auditing web services through the introduction of Network Provenance Functions (NPFs). NPFs are a distributed architecture for capturing detailed data provenance for web service components, leveraging the key insight that mediation of an application’s protocols can be used to infer its activities without requiring invasive instrumentation or developer cooperation. We design and implement NPF with consideration for the complexity of modern cloud-based web services, and evaluate our architecture against a variety of applications including DVDStore, RUBiS, and WikiBench to show that our system imposes as little as 9.3% average end-to-end overhead on connections for realistic workloads. Finally, we consider several scenarios in which our system can be used to concisely explain attacks. NPF thus enables the hassle-free deployment of semantically rich provenance-based auditing for complex applications workflows in the Cloud.
@inproceedings{bates2017transparent, title = {Transparent web service auditing via network provenance functions}, author = {Bates, Adam and Hassan, Wajih Ul and Butler, Kevin and Dobra, Alin and Reaves, Bradley and Cable, Patrick and Moyer, Thomas and Schear, Nabil}, year = {2017}, booktitle = {International World Wide Web Conference (WWW)}, doi = {10.1145/3038912.3052640} }
ATC
Don’t cry over spilled records: Memory elasticity of data-parallel applications and its application to cluster scheduling

Calin Iorgulescu, Florin Dinu, Aunn Raza, Wajih Ul Hassan, and Willy Zwaenepoel

In USENIX Annual Technical Conference (ATC), 2017

Abstract Bib PDF

Understanding the performance of data-parallel work-loads when resource-constrained has significant practical importance but unfortunately has received only limited attention. This paper identifies, quantifies and demonstrates memory elasticity, an intrinsic property of data-parallel tasks. Memory elasticity allows tasks to run with significantly less memory than they would ideally need while only paying a moderate performance penalty. For example, we find that given as little as 10% of ideal memory, PageRank and NutchIndexing Hadoop reducers become only 1.2x/1.75x and 1.08x slower. We show that memory elasticity is prevalent in the Hadoop, Spark, Tez and Flink frameworks. We also show that memory elasticity is predictable in nature by building simple models for Hadoop and extending them to Tez and Spark. To demonstrate the potential benefits of leveraging memory elasticity, this paper further explores its application to cluster scheduling. In this setting, we observe that the resource vs. time trade-off enabled by memory elasticity becomes a task queuing time vs. task runtime trade-off. Tasks may complete faster when scheduled with less memory because their waiting time is reduced. We show that a scheduler can turn this task-level trade-off into improved job completion time and cluster-wide memory utilization. We have integrated memory elasticity into Apache YARN. We show gains of up to 60% in average job completion time on a 50-node Hadoop cluster. Extensive simulations show similar improvements over a large number of scenarios.
@inproceedings{iorgulescu2017don, title = {Don't cry over spilled records: Memory elasticity of data-parallel applications and its application to cluster scheduling}, author = {Iorgulescu, Calin and Dinu, Florin and Raza, Aunn and Hassan, Wajih Ul and Zwaenepoel, Willy}, year = {2017}, booktitle = {USENIX Annual Technical Conference (ATC)}, }

2016

ASE
How good are the specs? A study of the bug-finding effectiveness of existing Java API specifications

Owolabi Legunsen, Wajih Ul Hassan, Xinyue Xu, Grigore Roşu, and Darko Marinov

In IEEE/ACM International Conference on Automated Software Engineering (ASE), 2016

Abstract Bib PDF 🏅 Distinguished Paper Award

Runtime verification can be used to find bugs early, during software development, by monitoring test executions against formal specifications (specs). The quality of runtime verification depends on the quality of the specs. While previous research has produced many specs for the Java API, manually or through automatic mining, there has been no large-scale study of their bug-finding effectiveness.
@inproceedings{legunsen2016good, title = {How good are the specs? A study of the bug-finding effectiveness of existing Java API specifications}, author = {Legunsen, Owolabi and Hassan, Wajih Ul and Xu, Xinyue and Ro{\c{s}}u, Grigore and Marinov, Darko}, booktitle = {IEEE/ACM International Conference on Automated Software Engineering (ASE)}, pages = {602--613}, year = {2016}, doi = {10.1145/2970276.2970356} }