Pith. sign in

REVIEW 3 major objections 6 minor 57 references

LESS: Efficient Log Storage System Based on Learned Model and Minimum Attribute Tree

T0 review · 3 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read LESS stores provenance graphs losslessly by learning the structure with XGBoost and arranging attributes as an edit-operation tree—6.29x faster storage, 5.24x less disk, 18.3x faster queries than the leading learned baseline.

desk verdict LESS has a sensible learned-storage design, but the reported accuracy and calibration-table sizes don't reconcile, which undercuts the headline compression numbers. read the letter →

arxiv 2411.17091 v1 pith:ADL3GI3L submitted 2024-11-26 cs.CR

Zhiyang Cheng , Zizhen Zhu , Haoran Dang , Hai Wan , Xibin Zhao This is my paper · ORCID
classification cs.CR
keywords provenancegraphstoragelosslesscompressionlearnedmodelsXGBoostminimumspanningtreeauditlogattackinvestigationcalibrationtable
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LESS is a storage system for provenance graphs—the dependency graphs analysts use to trace how an attack unfolded. The paper's central claim is that a provenance graph can be stored losslessly by splitting it into structure (nodes and edges) and attributes (process names, timestamps, paths) and giving each half its own compression scheme: an XGBoost model learns the vectorized adjacency structure while a small calibration table fixes the model's mistakes, and a minimum attribute tree stores each attribute string as edit operations relative to a parent string so common text is recorded once. On the public benchmark datasets the authors report that LESS uses 5.24x less disk than the previous learned-storage system, stores 6.29x faster, answers queries 18.3x faster, and runs in 11.5% of the memory. The motivation is practical: defenders must keep audit logs for long periods, and any lossless scheme that makes archives smaller and queries quicker lowers the cost and latency of forensic investigation. The paper argues the split itself is the key insight, because the two halves have different redundancy profiles.

What carries the argument

Two mechanisms carry the compression. The first is a model-plus-calibration-table: XGBoost, a gradient-boosted decision tree whose size is controlled by max depth and number of trees, predicts the next symbol of a vectorized adjacency list, and a calibration table records every misprediction as an (offset, correct value) pair with a compact byte encoding; this pair converts a lossy predictor into an exact store. The second is the minimum attribute tree, a minimum spanning tree over attribute strings built from a similarity matrix of bag-of-words Manhattan distances, where each tree edge stores insertion, deletion, and substitution operations relative to its parent and overly distant strings are stored verbatim instead of as edits. Combined, these turn a provenance graph into three files whose total size the paper reports as roughly 2-3% of the uncompressed graph on the evaluation datasets.

What would settle it

Using the vectorization and calibration procedures described in the paper, recompute the calibration-table size from the XGBoost model's actual mispredictions on one of the evaluation graphs. If, at the reported accuracy of about 0.71-0.77, the resulting table is much larger than the reported hundreds of kilobytes, then the accuracy metric is not per character and the lossless-compression claim needs re-derivation.

Watch

Extended reading notes

Core claim

The authors set out to show that learned compression can be made lossless and fast for provenance graphs, and that the way to do it is to stop treating a graph as one object. They claim the structure and the attributes have different statistical profiles and therefore need different stores: the structure is delta- and run-length-encoded into a short alphabet, learned by an XGBoost classifier, and corrected by a calibration table of (offset, value) pairs; the attributes are turned into bag-of-words vectors, compared by Manhattan distance inside a sliding window, and organized into a minimum spanning tree whose edges record only the edit operations needed to transform a parent string into a child string. The final artifacts—a small model, a calibration table, and the attribute trees—are sufficient to rebuild the original graph exactly, so nothing is discarded. The experimental claim is that this combination beats the leading learned-storage baseline by 5.24x on disk, 6.29x on storage time, and 18.3x on query speed while using a fraction of the memory.

Load-bearing premise

The whole scheme assumes that the two halves are compressible: the XGBoost model's prediction errors are few enough that the calibration table stays far smaller than the raw structure, and neighboring attribute strings are similar enough that edit-operation trees beat storing strings verbatim.

Editorial extensions

If this is right

  • If the numbers hold, long-term cyber defense could keep years of audit logs at a few percent of their raw size while still running backtrace and forward-trace queries on demand.
  • Because a query rebuilds the structure once in a warm-up phase and then follows parent pointers in the attribute tree, latency no longer scales with repeated model inference, the bottleneck of iterative learned approaches.
  • The split design makes each half independently replaceable: the paper explicitly notes that other machine-learning models can be substituted for XGBoost without changing the rest of the pipeline.
  • Losslessness means restored graphs can feed any downstream analysis—anomaly detection, graph reduction, attack investigation—exactly as the original would, and reduced or labeled graphs can be stored in the same format.
  • For very large graphs, the paper shows that slicing the input keeps storage and memory feasible; the cost is that slice boundaries must be tracked outside the system.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same structure/attribute split should transfer to other repetitive semi-structured event graphs—network flows, telemetry streams, container runtime logs—where the skeleton is small and attributes repeat; that is a testable extension the paper does not attempt.
  • Since the bag-of-words and Manhattan-distance proxy discards character order, strings with the same characters in different orders will look artificially similar and generate more edit operations; a bounded n-gram encoding could raise compression at modest extra cost.
  • Allowing a child attribute to derive from any already-stored node, or sharing subtrees across many children, could cut redundancy further than a strict tree, at the price of more complex query path-finding.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. LESS is a provenance-graph storage system that splits the input graph into structure and attributes. The graph structure is delta- and run-length encoded into a 13-symbol vector, modeled with XGBoost, and stored as a trained model plus a calibration table that corrects mispredictions; graph attributes are stored as an approximate minimum attribute tree built from a window-based similarity matrix and edit operations. The paper reports experiments on DARPA TC, DARPA OpTC, and a self-collected Linux Audit dataset, claiming 6.29x less storage time, 5.24x less disk usage, 18.3x faster queries, and 11.5% of LEONARD's memory, along with ablations of model choice, window size, and dataset scale.

Significance. If the reported numbers are correct, LESS is a practical improvement for long-term provenance storage: separating structure from attributes is a clean design, the XGBoost-plus-calibration scheme is lightweight and CPU-friendly, the attribute tree exploits a useful locality heuristic, and the evaluation spans multiple datasets with per-component breakdowns. The per-phase time breakdowns and the ablation studies are valuable. However, the central efficiency claim is not currently verifiable because the model accuracy reported in Table VII is undefined and numerically inconsistent with the calibration-table sizes in Table VI; no code or artifact is linked despite a reference to an 'open-source link.' The contribution is significant if these numbers can be reproduced and the inconsistency resolved.

major comments (3)
  1. [Section II-B (Calibration); Tables VI and VII] The accuracy metric behind Table VII is never defined, and the reported values are hard to reconcile with the calibration-table sizes. With Acc around 0.71-0.72 for S1-S3, the per-symbol error rate is about 0.29; at roughly two bytes per correction (one byte for v plus one byte for delta, since delta > 127 is extremely unlikely at this accuracy), a 296KB calibration table accounts for only about 150K corrected symbols. S1 alone has 2.16M edges and an 18MB structure, so its decimal-expanded, delimiter-augmented vector should contain millions of symbols, implying on the order of a million corrections and several megabytes of calibration data. If 'Acc' is instead per row, per node, or per edge, the paper must say so, because in that case the accuracy value cannot be used to bound the calibration table as the text does. Since the structure-compression gain is precisely 'model plus calibration table versus raw structure,' this inconsistency directly affects the reported disk-reduction and losslessness/efficiency claims. Please state the exact accuracy definition, give the resulting vector lengths for S1-S5, and show how the calibration-table byte counts follow from them.
  2. [Section III-B (Query Speed); Table II] The headline '18.3x faster query speed' is computed after a separate 'Warm up' phase that reconstructs the entire graph structure, and this warm-up takes 68-96 seconds on D1-D5. For point queries used in forensic investigation, this warm-up is part of the user-visible latency and is not amortized unless many queries are issued against the same reconstructed structure. The comparison with LEONARD and SEAL should either report end-to-end latency including warm-up for the evaluated 100-node query workload, or explicitly justify why excluding warm-up is the appropriate comparison for the intended use case.
  3. [Section II-B (Model Training and Inference)] The prediction procedure is not specified precisely enough to verify the lossless reconstruction claim. The text says the graph-structure vectors are inputs and 'predicted subsequent characters' are outputs, and that a fixed sequence is used as a starting point to obtain a predicted vector of equal length, but it does not describe the feature window, the autoregressive decoding loop, the choice of the fixed starting sequence, or the stopping criterion for 'accuracy stabilizes.' Without these details, a reader cannot reproduce the model, the calibration table, or the query-time reconstruction; please provide a precise algorithm or pseudocode for both training-time and inference-time prediction.
minor comments (6)
  1. [Abstract and Section III-B] The paper says LESS is faster in storage time and query speed than 'current approaches,' but Section III-B reports that SEAL has lower storage time and higher query speed than LESS. The summary should scope the headline comparison to LEONARD or explicitly state the trade-off with SEAL.
  2. [Section III-A] The text mentions an 'open-source link,' but no code repository URL appears in the paper. Please include the artifact link, or state that the artifact will be released with the camera-ready version.
  3. [Section II-C (Algorithm 2)] Algorithm 2 computes a minimum spanning tree over a similarity matrix that contains +infinity for out-of-window pairs and then applies a max-distance cutoff; if the resulting graph is disconnected, the output is a forest rather than a single tree. The pseudocode should specify how the chosen MST algorithm handles disconnected components.
  4. [Section II-C (Similarity Matrix Computing)] The sentence that the bag-of-words plus Manhattan distance 'is the number of different characters between the statistical attribute strings' is imprecise: the Manhattan distance between character-count vectors is the sum of absolute count differences, which is only an approximation of edit distance and not a count of differing character types.
  5. [Figure 3] The x-axis labels in the locality histograms are densely packed and unreadable at print size; a cumulative distribution plot or binned histogram would convey the locality argument more clearly.
  6. [Section III-C-5, Table VII] The text says tuning 'max depth' and 'n estimators' gives 'almost consistent accuracy' across S1-S5, but accuracy jumps from 0.7153 (S3) to 0.7683 (S4) when max depth changes from 1 to 3. Please clarify whether this jump is expected and how the hyperparameters are selected.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: LESS is a self-contained lossless compression scheme; model calibration is part of the stored artifact, not a fitted prediction.

full rationale

LESS's central claim is that a provenance graph can be stored losslessly as an XGBoost model plus a calibration table (for graph structure) and a minimum attribute tree built from edit operations (for attributes). These are encoding choices, not predictions of unseen data. Section II-B states: 'Since the complete provenance graph is used for training and all the mispredictions are corrected, the storage system saves information in a lossless fashion.' The calibration table records (delta, v) offsets and correct values, so model error is stored as part of the representation; the 'Acc' reported in Table VII is training-set fit quality, and no held-out generalization is claimed as a result. Similarly, Section II-C's attribute tree stores edit operations relative to parent nodes, guaranteeing reconstruction by applying operations from the root; the paper explicitly says 'within the attribute tree, all attribute strings can be fully restored by executing edit operations downward from the root node.' Comparisons to LEONARD and SEAL are external benchmarks, and LEONARD is by different authors and is not used to justify LESS's own construction. The discussion section's limitations (e.g., no ACID, slicing not part of LESS) are scoping statements, not circular reasoning. The only notable concern is internal consistency: Table VII reports Acc of 0.7109-0.7662 on S1-S5 while Table VI lists calibration tables of only 296KB-1.32MB, and the metric 'Acc' is never defined; for OpTC structure sizes this appears inconsistent, but that is a correctness/evidence risk rather than circularity. No load-bearing step reduces to its own input by construction or by self-citation.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim rests on a small number of hand-chosen parameters (window size, max distance, XGBoost hyperparameters) and on the empirical assumption that provenance graph structures and attributes are highly compressible by the proposed learned model and tree encoding. No new physical entities are introduced. The main burden is that these assumptions are validated only on a small set of datasets without code release or clearly defined accuracy metrics.

free parameters (4)
  • max distance (attribute tree) = 60
    Threshold in Algorithm 2 for including an edge in the attribute tree. Set by hand; affects whether edit operations are stored or full strings are kept, directly impacting compression ratio.
  • window size (similarity matrix) = 4 on DARPA TC, 6 on OpTC
    Controls how many neighboring attributes are compared when building the similarity matrix. Tuned per dataset family in Section III-C-3.
  • XGBoost max depth = 3 (D), 1-3 (S), 6 (A*)
    Hyperparameter controlling model capacity and hence model size and calibration table size. Set differently across experiments.
  • XGBoost n estimators = 3 (D/S), 6 (A*)
    Number of trees; controls model size and training time. See Table VII.
assumptions (4)
  • domain assumption Provenance graph structures, after delta and run-length encoding, are compressible by a small XGBoost model with a compact calibration table.
    The whole structure storage scheme depends on the model achieving high accuracy on the training set; Section II-B. Reported accuracies in Table VII (0.71-0.77) are not clearly reconciled with the small calibration tables.
  • domain assumption Attribute strings in provenance graphs share sufficient similarity that a minimum spanning tree over a windowed similarity matrix yields a compact tree of edit operations.
    Motivated by 'locality of logs' in Section II-C; measured via edit distance histograms in Figure 3.
  • domain assumption The bag-of-words Manhattan distance is a sufficient approximation of edit distance for selecting similar attribute strings.
    Section II-C; the paper reports a 3.8% disk increase from this approximation, so it is a pragmatic choice.
  • standard math Standard ML and algorithm libraries (XGBoost, sklearn, numpy) behave as documented.
    Used throughout the implementation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LESS: Efficient Log Storage System Based on Learned Model and Minimum Attribute Tree." pith.science (2026). https://pith.science/paper/ADL3GI3L

@misc{pith2026241117091,
  author       = {Pith},
  title        = {Pith review of: LESS: Efficient Log Storage System Based on Learned Model and Minimum Attribute Tree},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ADL3GI3L}},
  note         = {Machine review of arXiv:2411.17091}
}
read the original abstract

In recent years, cyber attacks have become increasingly sophisticated and persistent. Detection and investigation based on the provenance graph can effectively mitigate cyber intrusion. However, in the long time span of defenses, the sheer size of the provenance graph will pose significant challenges to the storage systems. Faced with long-term storage tasks, existing methods are unable to simultaneously achieve lossless information, efficient compression, and fast query support. In this paper, we propose a novel provenance graph storage system, LESS, which consumes smaller storage space and supports faster storage and queries compared to current approaches. We innovatively partition the provenance graph into two distinct components, the graph structure and attribute, and store them separately. Based on their respective characteristics, we devise two appropriate storage schemes: the provenance graph structure storage method based on machine learning and the use of the minimal spanning tree to store the graph attributes. Compared with the state-of-the-art approach, LEONARD, LESS reduces 6.29 times in storage time, while also achieving a 5.24 times reduction in disk usage and an 18.3 times faster query speed while using only 11.5% of the memory on DARPA TC dataset.

Figures

Figures reproduced from arXiv: 2411.17091 by the authors.

Figure 1
Figure 1. A Provenance Graph Example. Logs are usually semi-structural and non-structural text files. Due to these characteristics, analyzing such logs to detect anomalies in a short time is difficult and error-prone. *Equal Contribution. arXiv:2411.17091v1 [cs.CR] 26 Nov 2024 [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of storage process of LESS: We input the provenance graph in Figure 1 to LESS. First, we split the provenance [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Locality on different logs. the number of unrepeated characters in the dataset. We assume that the set of unduplicated character in the dataset is D. D = {c1, c2, ..., cn} For any string S composed of characters in D, define mapping F, F(S) is a character-level Bag-of-words represen￾tation of S, Z |D| is an integer space with cardinality of D as dimension. F : S → Z |D| We define I as a indicator function, and the i… view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Overview of the querying process of LESS: We input [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 6
Figure 6. Figure 6: Performance of LESS with different window size. [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 5
Figure 5. Figure 5: Performance of LESS with the Bag-of-words and [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 7
Figure 7. Figure 7: Structure storage with different models 4) Different Models: We investigate how different models affect the storage of graph structures. We chose XGBoost, Decision Tree, Naive Bayes, 1D-CNN, LSTM, and GRU models for comparison. In XGBoost, we set max depth at 5. Decisi…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 50 canonical work pages

  1. [1]

    trace - Google Drive — drive.google.com,

    “trace - Google Drive — drive.google.com,” https://drive.google.com/ drive/folders/1s2AIHZ-I9myS tJ3FsLgz vdzu7PBYvv, 2019

    work page 2019

  2. [2]

    20-23Sep19 - Google Drive — drive.google.com,

    “20-23Sep19 - Google Drive — drive.google.com,” https://drive.google. com/drive/folders/1sB-rPVO84iv0OqkJiCilDLKWxklh7EYm, 2020

    work page 2020

  3. [3]

    DTrace - FreeBSD Wiki — wiki.freebsd.org,

    “DTrace - FreeBSD Wiki — wiki.freebsd.org,” https://wiki.freebsd.org/ DTrace, 2022

    work page 2022

  4. [4]

    2023 Cyber Security Statistics The Ultimate List Of Stats, Data & Trends - PurpleSec — purplesec.us,

    “2023 Cyber Security Statistics The Ultimate List Of Stats, Data & Trends - PurpleSec — purplesec.us,” https://purplesec.us/resources/ cyber-security-statistics/#APTs, 2023. 13

    work page 2023

  5. [5]

    Runs on single machine, Hadoop, Spark, Dask, Flink and DataFlow — github.com,” https://github.com/dmlc/xgboost, 2024

    “GitHub - dmlc/xgboost: Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library, for Python, R, Java, Scala, C++ and more. Runs on single machine, Hadoop, Spark, Dask, Flink and DataFlow — github.com,” https://github.com/dmlc/xgboost, 2024

    work page 2024

  6. [6]

    GitHub - scikit-learn/scikit-learn: scikit-learn: machine learning in Python — github.com,

    “GitHub - scikit-learn/scikit-learn: scikit-learn: machine learning in Python — github.com,” https://github.com/scikit-learn/scikit-learn, 2024

    work page 2024

  7. [7]

    MITRE ATT&CK; — attack.mitre.org,

    “MITRE ATT&CK; — attack.mitre.org,” https://attack.mitre.org/, 2024

    work page 2024

  8. [8]

    “Neo4j,” https://neo4j.com, 2024

    work page 2024

Show all 57 references
  1. [9]

    pytorch/torch/nn at main · pytorch/pytorch — github.com,

    “pytorch/torch/nn at main · pytorch/pytorch — github.com,” https: //github.com/pytorch/pytorch/tree/main/torch/nn, 2024

    2024

  2. [10]

    Redis - The Real-time Data Platform — redis.io,

    “Redis - The Real-time Data Platform — redis.io,” https://redis.io/, 2024

    2024

  3. [11]

    {ATLAS}: A sequence-based learning approach for attack investigation,

    A. Alsaheel, Y . Nan, S. Ma, L. Yu, G. Walkup, Z. B. Celik, X. Zhang, and D. Xu, “ {ATLAS}: A sequence-based learning approach for attack investigation,” in 30th USENIX security symposium (USENIX security 21), 2021, pp. 3005–3022

    2021

  4. [12]

    Xgboost: A scalable tree boosting system,

    T. Chen and C. Guestrin, “Xgboost: A scalable tree boosting system,” in Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining, 2016, pp. 785–794

    2016

  5. [13]

    Transparent computing,

    DARPA, “Transparent computing,” https://www.darpa.mil/program/ transparent-computing, 2014

    2014

  6. [14]

    GitHub - dhl123/Leonard: Usenix Security’23 — github.com,

    dhl123, “GitHub - dhl123/Leonard: Usenix Security’23 — github.com,” https://github.com/dhl123/Leonard, 2023

    2023

  7. [15]

    The case for learned prove- nance graph storage systems,

    H. Ding, J. Zhai, D. Deng, and S. Ma, “The case for learned prove- nance graph storage systems,” in 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 3277–3294

    2023

  8. [16]

    Event Tracing for Windows (ETW) - Windows drivers — learn.microsoft.com,

    DOMARS, “Event Tracing for Windows (ETW) - Windows drivers — learn.microsoft.com,” https://learn.microsoft.com/en-us/ windows-hardware/drivers/devtest/event-tracing-for-windows--etw-, 2023

    2023

  9. [17]

    Deeplog: Anomaly de- tection and diagnosis from system logs through deep learning,

    M. Du, F. Li, G. Zheng, and V . Srikumar, “Deeplog: Anomaly de- tection and diagnosis from system logs through deep learning,” in Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, 2017, pp. 1285–1298

    2017

  10. [18]

    {SEAL}: Storage- efficient causality analysis on enterprise logs with query-friendly com- pression,

    P. Fei, Z. Li, Z. Wang, X. Yu, D. Li, and K. Jee, “ {SEAL}: Storage- efficient causality analysis on enterprise logs with query-friendly com- pression,” in 30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 2987–3004

    2021

  11. [19]

    Spade: Support for provenance audit- ing in distributed environments,

    A. Gehani and D. Tariq, “Spade: Support for provenance audit- ing in distributed environments,” in ACM/IFIP/USENIX International Conference on Distributed Systems Platforms and Open Distributed Processing. Springer, 2012, pp. 101–120

    2012

  12. [20]

    The gzip home page — gzip.org,

    Gzip.Org, “The gzip home page — gzip.org,” https://www.gzip.org, 2024

    2024

  13. [21]

    Unicorn: Runtime provenance-based detector for advanced persistent threats,

    X. Han, T. Pasquier, A. Bates, J. Mickens, and M. Seltzer, “Unicorn: Runtime provenance-based detector for advanced persistent threats,” arXiv preprint arXiv:2001.01525, 2020

    2001 arXiv

  14. [22]

    {FRAPpuccino}: Fault-detection through runtime analysis of prove- nance,

    X. Han, T. Pasquier, T. Ranjan, M. Goldstein, and M. Seltzer, “{FRAPpuccino}: Fault-detection through runtime analysis of prove- nance,” in 9th USENIX Workshop on Hot Topics in Cloud Computing (HotCloud 17), 2017

    2017

  15. [23]

    Towards scalable cluster auditing through grammatical inference over provenance graphs,

    W. U. Hassan, L. Aguse, N. Aguse, A. Bates, and T. Moyer, “Towards scalable cluster auditing through grammatical inference over provenance graphs,” in Network and Distributed Systems Security Symposium, 2018

    2018

  16. [24]

    Tactical provenance analysis for endpoint detection and response systems,

    W. U. Hassan, A. Bates, and D. Marino, “Tactical provenance analysis for endpoint detection and response systems,” in2020 IEEE Symposium on Security and Privacy (SP). IEEE, 2020, pp. 1172–1189

    2020

  17. [25]

    Nodoze: Combatting threat alert fatigue with automated provenance triage,

    W. U. Hassan, S. Guo, D. Li, Z. Chen, K. Jee, Z. Li, and A. Bates, “Nodoze: Combatting threat alert fatigue with automated provenance triage,” in network and distributed systems security symposium, 2019

    2019

  18. [26]

    This is why we can’t cache nice things: Lightning-fast threat hunting using suspicion-based hierarchi- cal storage,

    W. U. Hassan, D. Li, K. Jee, X. Yu, K. Zou, D. Wang, Z. Chen, Z. Li, J. Rhee, J. Gui et al., “This is why we can’t cache nice things: Lightning-fast threat hunting using suspicion-based hierarchi- cal storage,” in Proceedings of the 36th Annual Computer Security Applications C...

    2020

  19. [27]

    Omegalog: High-fidelity attack investigation via transparent multi-layer log analy- sis,

    W. U. Hassan, M. A. Noureddine, P. Datta, and A. Bates, “Omegalog: High-fidelity attack investigation via transparent multi-layer log analy- sis,” in Network and distributed system security symposium, 2020

    2020

  20. [28]

    Chapter 7. System Auditing Red Hat Enterprise Linux 6 — Red Hat Customer Portal — access.redhat.com,

    R. Hat, “Chapter 7. System Auditing Red Hat Enterprise Linux 6 — Red Hat Customer Portal — access.redhat.com,” https://access.redhat.com/documentation/en-us/red hat enterprise linux/6/html/security guide/chap-system auditing, 2024

    2024

  21. [29]

    {SLEUTH}: Real- time attack scenario reconstruction from {COTS} audit data,

    M. N. Hossain, S. M. Milajerdi, J. Wang, B. Eshete, R. Gjomemo, R. Sekar, S. Stoller, and V . Venkatakrishnan, “ {SLEUTH}: Real- time attack scenario reconstruction from {COTS} audit data,” in 26th USENIX Security Symposium (USENIX Security 17), 2017, pp. 487– 504

    2017

  22. [30]

    {Dependence- Preserving} data compaction for scalable forensic analysis,

    M. N. Hossain, J. Wang, O. Weisse, R. Sekar, D. Genkin, B. He, S. D. Stoller, G. Fang, F. Piessens, E. Downing et al., “ {Dependence- Preserving} data compaction for scalable forensic analysis,” in 27th USENIX Security Symposium (USENIX Security 18), 2018, pp. 1723– 1740

    2018

  23. [31]

    Sok: History is a vast early warning system: Auditing the provenance of system intrusions,

    M. A. Inam, Y . Chen, A. Goyal, J. Liu, J. Mink, N. Michael, S. Gaur, A. Bates, and W. U. Hassan, “Sok: History is a vast early warning system: Auditing the provenance of system intrusions,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 2620–2638

    2023

  24. [32]

    Faust: Striking a bargain between forensic au- diting’s security and throughput,

    M. A. Inam, A. Goyal, J. Liu, J. Mink, N. Michael, S. Gaur, A. Bates, and W. U. Hassan, “Faust: Striking a bargain between forensic au- diting’s security and throughput,” in Proceedings of the 38th Annual Computer Security Applications Conference, 2022, pp. 813–826

    2022

  25. [33]

    Backtracking intrusions,

    S. T. King and P. M. Chen, “Backtracking intrusions,” in Proceedings of the nineteenth ACM symposium on Operating systems principles, 2003, pp. 223–236

    2003

  26. [34]

    High accuracy attack provenance via binary-based execution partition

    K. H. Lee, X. Zhang, and D. Xu, “High accuracy attack provenance via binary-based execution partition.” in NDSS, vol. 16, 2013

    2013

  27. [35]

    Loggc: garbage collecting audit log,

    ——, “Loggc: garbage collecting audit log,” in Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, 2013, pp. 1005–1016

    2013

  28. [36]

    Threat detection and investigation with system-level provenance graphs: a survey,

    Z. Li, Q. A. Chen, R. Yang, Y . Chen, and W. Ruan, “Threat detection and investigation with system-level provenance graphs: a survey,” Computers & Security, vol. 106, p. 102282, 2021

    2021

  29. [37]

    Propatrol: Attack investigation via extracted high-level tasks,

    S. M. Milajerdi, B. Eshete, R. Gjomemo, and V . N. Venkatakrishnan, “Propatrol: Attack investigation via extracted high-level tasks,” in Information Systems Security: 14th International Conference, ICISS 2018, Bangalore, India, December 17-19, 2018, Proceedings 14. Springer, 2...

    2018

  30. [38]

    Fast memory-efficient anomaly detection in streaming heterogeneous graphs,

    E. Manzoor, S. M. Milajerdi, and L. Akoglu, “Fast memory-efficient anomaly detection in streaming heterogeneous graphs,” in Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, 2016, pp. 1035–1044

    2016

  31. [39]

    On the forensic validity of approximated audit logs,

    N. Michael, J. Mink, J. Liu, S. Gaur, W. U. Hassan, and A. Bates, “On the forensic validity of approximated audit logs,” in Proceedings of the 36th Annual Computer Security Applications Conference, 2020, pp. 189–202

    2020

  32. [40]

    Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting,

    S. M. Milajerdi, B. Eshete, R. Gjomemo, and V . Venkatakrishnan, “Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting,” in Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, 2019, pp. 1795–1812

    2019

  33. [41]

    Holmes: real-time apt detection through correlation of suspicious information flows,

    S. M. Milajerdi, R. Gjomemo, B. Eshete, R. Sekar, and V . Venkatakrish- nan, “Holmes: real-time apt detection through correlation of suspicious information flows,” in 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 1137–1152

    2019

  34. [42]

    Darpa OpTC,

    OpenDataLab, “Darpa OpTC,” https://opendatalab.com/OpenDataLab/ Darpa OpTC, 2019

    2019

  35. [43]

    MySQL — mysql.com,

    ORACLE, “MySQL — mysql.com,” https://www.mysql.com, 2024

    2024

  36. [44]

    Hercule: Attack story reconstruction via com- munity discovery on correlated log graph,

    K. Pei, Z. Gu, B. Saltaformaggio, S. Ma, F. Wang, Z. Zhang, L. Si, X. Zhang, and D. Xu, “Hercule: Attack story reconstruction via com- munity discovery on correlated log graph,” in Proceedings of the 32Nd Annual Conference on Computer Security Applications, 2016, pp. 583– 595

    2016

  37. [45]

    Learning string-edit distance,

    E. S. Ristad and P. N. Yianilos, “Learning string-edit distance,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 20, no. 5, pp. 522–532, 1998

    1998

  38. [46]

    Provtalk: Towards interpretable multi-level provenance analysis in networking functions virtualization (nfv)

    A. Tabiban, H. Zhao, Y . Jarraya, M. Pourzandi, M. Zhang, and L. Wang, “Provtalk: Towards interpretable multi-level provenance analysis in networking functions virtualization (nfv).” in NDSS, 2022. 14

    2022

  39. [47]

    Nodemerge: Template based efficient data reduction for big-data causality analysis,

    Y . Tang, D. Li, Z. Li, M. Zhang, K. Jee, X. Xiao, Z. Wu, J. Rhee, F. Xu, and Q. Li, “Nodemerge: Template based efficient data reduction for big-data causality analysis,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018, pp. 1324–1337

    2018

  40. [48]

    Deepcase: Semi-supervised contextual analysis of security events,

    T. Van Ede, H. Aghakhani, N. Spahn, R. Bortolameotti, M. Cova, A. Continella, M. van Steen, A. Peter, C. Kruegel, and G. Vigna, “Deepcase: Semi-supervised contextual analysis of security events,” in 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, pp. 522–539

    2022

  41. [49]

    Pagoda: A hybrid approach to enable efficient real-time provenance based intrusion detection in big data environments,

    Y . Xie, D. Feng, Y . Hu, Y . Li, S. Sample, and D. Long, “Pagoda: A hybrid approach to enable efficient real-time provenance based intrusion detection in big data environments,” IEEE Transactions on Dependable and Secure Computing, vol. 17, no. 6, pp. 1283–1296, 2018

    2018

  42. [50]

    Unifying intrusion detection and forensic analysis via provenance awareness,

    Y . Xie, D. Feng, Z. Tan, and J. Zhou, “Unifying intrusion detection and forensic analysis via provenance awareness,” Future Generation Computer Systems, vol. 61, pp. 26–36, 2016

    2016

  43. [51]

    P-gaussian: provenance-based gaussian distribution for detecting intrusion behavior variants using high efficient and real time memory databases,

    Y . Xie, Y . Wu, D. Feng, and D. Long, “P-gaussian: provenance-based gaussian distribution for detecting intrusion behavior variants using high efficient and real time memory databases,” IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 6, pp. 2658–2674, 2019

    2019

  44. [52]

    High fidelity data reduction for big data security dependency analyses,

    Z. Xu, Z. Wu, Z. Li, K. Jee, J. Rhee, X. Xiao, F. Xu, H. Wang, and G. Jiang, “High fidelity data reduction for big data security dependency analyses,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016, pp. 504–516

    2016

  45. [53]

    Depcomm: Graph summarization on system audit logs for attack investigation,

    Z. Xu, P. Fang, C. Liu, X. Xiao, Y . Wen, and D. Meng, “Depcomm: Graph summarization on system audit logs for attack investigation,” in 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, pp. 540–557

    2022

  46. [54]

    Uiscope: Accurate, instrumentation-free, and visible attack investigation for gui applica- tions

    R. Yang, S. Ma, H. Xu, X. Zhang, and Y . Chen, “Uiscope: Accurate, instrumentation-free, and visible attack investigation for gui applica- tions.” in NDSS, 2020

    2020

  47. [55]

    Watson: Abstracting behaviors from audit logs via aggregation of contextual semantics

    J. Zeng, Z. L. Chua, Y . Chen, K. Ji, Z. Liang, and J. Mao, “Watson: Abstracting behaviors from audit logs via aggregation of contextual semantics.” in NDSS, 2021

    2021

  48. [56]

    Shadewatcher: Recommendation-guided cyber threat analysis using system audit records,

    J. Zengy, X. Wang, J. Liu, Y . Chen, Z. Liang, T.-S. Chua, and Z. L. Chua, “Shadewatcher: Recommendation-guided cyber threat analysis using system audit records,” in 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, pp. 489–506

    2022

  49. [57]

    Understanding bag-of-words model: a statistical framework,

    Y . Zhang, R. Jin, and Z.-H. Zhou, “Understanding bag-of-words model: a statistical framework,” International journal of machine learning and cybernetics, vol. 1, pp. 43–52, 2010. 15

    2010

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.