Pith. sign in

REVIEW 3 major objections 6 minor 92 references

DEHYDRATOR: Enhancing Provenance Graph Storage via Hierarchical Encoding and Sequence Generation

T0 review · 3 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Dehydrator claims lossless provenance graph storage at one-sixth the original size while keeping queries exact.

desk verdict A genuinely new encoding for provenance graph storage, but the 16.17x claim over Leonard is an artifact of comparing against Leonard's uncompressed ECT. read the letter →

arxiv 2501.00446 v1 pith:5B7KRFML submitted 2024-12-31 cs.CR

Jie Ying , Tiantian Zhu , Mingqi Lv , Tieming Chen This is my paper · ORCID
classification cs.CR
keywords provenancegraphstoragecompressionhierarchicalencodingfieldmappingsequencegenerationerrorcorrectiontablecausalityanalysisauditlog
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes Dehydrator, a storage system for provenance graphs built from kernel audit logs, and argues that it can store such graphs losslessly in about one-sixth of their original space while still answering the reverse queries analysts use for attack investigation. Across seven datasets with over one billion log entries, the paper reports an average reduction of 84.55 percent, from roughly 1,598 MB of edge-table data to 247 MB of stored artifacts. The reason the reduction is possible, the paper argues, is that provenance graphs carry two distinct kinds of redundancy: repeated field values within entries and repeated structure across the many parallel edges connecting the same node pair. Dehydrator removes both kinds before training a small transformer to regenerate the encoded edge information on demand, with an error-correction table guaranteeing that every returned query is exact. If the claim holds, provenance storage can be made dramatically cheaper without forcing the lossy pruning that earlier compression approaches accept.

What carries the argument

The load-bearing object is the hierarchical edge table $ET_{hi}$ produced by Algorithm 1. For each node $v$, Dehydrator stores a record $[v, startTime, endTime, U_v, MergedEdge]$, where $U_v$ indexes the distinct source nodes and $MergedEdge$ is a nested list $[Operation:[timeOffset:[nodeOffset]]]$ that folds all incoming edges into one dense structure. This encoding converts the storage problem from storing each edge separately into storing one compact record per node, which raises information density enough that a small transformer can fit the data in a few epochs. The error-correction table, which records mismatches between model output and true data, then makes the system content-lossless even when the model is imperfect.

What would settle it

Compress Dehydrator's three stored artifacts (merge mapping table, model weights, and error-correction table) with gzip or zstd and compare the total against the reported 247 MB and against the closest baseline's compressed footprint; if the compressed total approaches or exceeds the baselines' totals, the 84.55 percent and 16.17x claims do not survive a uniform compression metric.

Watch

Extended reading notes

Core claim

Dehydrator's central claim is that structure-level redundancy, not field-level redundancy, dominates the storage cost of provenance graphs, and that eliminating it through hierarchical encoding makes DNN-based lossless storage practical. The system first maps unique, repetitive, and incremental field values to short codes and offsets, then regroups the encoded edge table so that each node appears once with all of its incoming edges merged into a nested list keyed by operation, time offset, and source-node offset. A single-layer decoder-only transformer is trained on these dense sequences, and an error-correction table records every position where the model's generated output differs from the true data, so queries combine model output with table corrections to return exact results. On the seven evaluated datasets the stored size drops from an average of about 1,598 MB to 247 MB, which the paper reports as an 84.55 percent reduction, and as 7.36x smaller than PostgreSQL, 7.16x smaller than Neo4j, and 16.17x smaller than Leonard.

Load-bearing premise

The headline storage comparison assumes that measuring Dehydrator's error-correction table in uncompressed bytes while using the closest baseline's reported sizes is the right metric; because the error-correction table makes up over 90 percent of Dehydrator's stored size, a standard compressor applied to both systems' artifacts could shrink the claimed advantage.

Editorial extensions

If this is right

  • Average storage overhead on the seven datasets falls from about 1,598 MB to 247 MB, a reported 84.55 percent reduction.
  • Under the paper's metric, Dehydrator stores edge tables 7.36x more compactly than PostgreSQL, 7.16x more compactly than Neo4j, and 16.17x more compactly than Leonard.
  • Reverse causality queries at depths 1 through 4 complete in times comparable to PostgreSQL, while Neo4j remains faster; beyond depth 4, autoregressive generation becomes prohibitively slow.
  • Hierarchical encoding is shown to be beneficial only when the average node degree is at least 3, giving Dehydrator a clear applicability boundary and a lower-bound regime at degree 1.
  • The Latency-to-Storage Ratio peaks at a dataset-dependent model capacity, so the system has an operating point chosen by trading storage size against storage latency.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The 84.55 percent headline likely depends on the choice to measure Dehydrator's error-correction table uncompressed while the closest baseline is compared using its own reported sizes; applying gzip or zstd to Dehydrator's stored artifacts could change the comparison, since the error-correction table dominates Dehydrator's footprint.
  • The same hierarchical encoding idea should transfer to other high-degree directed graphs such as dependency graphs and system call traces, where parallel edges between entity pairs are common; a testable extension is to run Dehydrator's pipeline on non-security provenance graphs and check whether the degree-3 threshold still predicts when encoding helps.
  • Because model inference accounts for over 99 percent of query latency, non-autoregressive generation or speculative decoding could make Dehydrator competitive with graph databases on reverse BFS queries without changing its storage format.
  • An adaptive error-correction scheme that corrects at the sub-sequence level rather than the character level could cut the error-correction table further, pushing the stored footprint below the reported 247 MB average.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes Dehydrator, a provenance-graph storage system that combines three stages: field mapping encoding to remove field-level redundancy, hierarchical encoding to compress incoming-edge structure, and a single-layer decoder-only transformer with an error-correction table (ECT) to support batch queries. The evaluation on seven DARPA TC/DEPIMPACT provenance graphs reports a post-storage average of 247 MB against a pre-storage edge-table average of about 1,599 MB, i.e., an 84.55% reduction, and claims 7.36x, 7.16x, and 16.17x storage-efficiency improvements over PostgreSQL, Neo4j, and Leonard, respectively. The paper also studies the contribution of each component, the impact of model capacity through a Latency-to-Storage Ratio (LSR) metric, and the applicability of hierarchical encoding as a function of average degree.

Significance. If the reported reductions are reproducible, this is a useful contribution to cold storage of provenance graphs: it targets structure-level redundancy, which prior encoding-based systems address only partially, and it evaluates on substantially larger graphs than the closest learned-storage baseline. Strengths include the use of seven public datasets, an ablation of the encoding components, the explicit ECT mechanism for losslessness, and the introduction of LSR as a way to reason about the storage-latency tradeoff. The central edge-table reduction is an empirical result and does not appear to be forced by a fitted constant. However, the headline comparison with Leonard is not a normalized disk-usage comparison, and two technical points in the algorithm and the applicability derivation need correction before the central claims can be accepted as stated.

major comments (3)
  1. [§IV-B, Table IV] The 16.17x claim against Leonard is not an apples-to-apples disk-usage comparison. The paper itself states that Leonard's 3,592 MB ECT for G1 compresses to a 68 MB gzip file, so Leonard's actual stored and queryable artifact is the gzip ECT plus the 0.9 MB model, about 69 MB for G1. Dehydrator's BPpost, by contrast, counts its own ECT, MMT, and DNN uncompressed (60.9 MB for G1, 247 MB on average). Measured by the paper's own BPpost definition, i.e., bytes on disk, the G1 ratio is roughly 69/60.9, not 3,592/60.9, and the average 16.17x ratio is an artifact of comparing Dehydrator's stored files against Leonard's decompressed intermediate JSON. The defense in §IV-B that raw ECT must be counted because decompression and loading take 138 s is a query-latency argument, not a storage-metric argument, and it is applied asymmetrically. This invalidates the third headline comparative claim, although it does not by itself refute the absolute edge-table reduction.
  2. [Algorithm 1, lines 16-17] In Algorithm 1, startTime and endTime are computed inside the loop over v but after the inner loop over u, using Dict[(u, v)] where u is the last parent processed. This means the min/max timestamps are taken over edges of only the last parent, not over all incoming edges of v. The correct source for these extremes is the accumulated Ev list (or all pairs in Dict[v]). As printed, the pseudocode corrupts the temporal interval for every multi-parent node, and since timeOffset is defined as e.timestamp - startTime, the reconstructed edge timestamps would be wrong; this undermines the content-lossless claim. Please fix the pseudocode, and verify that the implementation computes startTime and endTime over all incoming edges.
  3. [§IV-E, Eqs. (4)-(5)] The derivation of the d_avg >= 3 applicability threshold rests on the assertion sum_v m_v^o <= 3n, justified by 'a node can have at most 3 operations of incoming edges.' The paper's own Table I lists at least five operation types (Read, Write, Execute, Sendto, Recvfrom, Fork), and different node types can receive different subsets, so a universal bound of 3 is not supported. Replacing the constant 3 by the actual vocabulary size O gives, under the paper's other bounds, a threshold of roughly (O+3)/2 for m/n, not a fixed threshold of 3. The synthetic P1-P5 experiments may still show threshold 3 for their generated data, but the analytical claim in Eq. (5) is incorrect as stated, and the experiments should report the operation vocabulary used so the reader can see why the bound holds there.
minor comments (6)
  1. [§III-B1, §IV-C, Table VI] Typos and formatting issues should be corrected: 'Fisrtly' in §III-B1, 'Grpahs' in the §IV-C heading, and 'Sgement Length' in Table VI.
  2. [Table IV] Table IV is difficult to parse as rendered because Leonard's BPpost and Ts are split into DNN/ECT and Train/Correct without explicit subheaders, and the same is true for Dehydrator's MMT/DNN/ECT and HE/Train/Correct columns. Add clear multi-level column headers so the sums shown in the text are unambiguous.
  3. [§IV-A and Abstract] The abstract's 'reduces the storage space by 84.55%' should be qualified as edge-table storage: the paper explicitly equates BPpre with ET and excludes the node table. Although ET dominates, the current wording overstates the reduction for the full provenance graph.
  4. [§IV-C] Leonard is excluded from the query comparison because loading its ECT takes several minutes, but the paper does not report that load/decompression time in Table V nor the memory footprint. Either report it as part of the query cost or state explicitly that the comparison excludes cold-start overhead for all systems.
  5. [§III-C] The claim that DNNs 'inherently support batch queries' is not supported by any experiment in the paper. Add a batch-mode query experiment or qualify the claim to refer to the potential for parallel generation.
  6. [General] The paper states that code and data will be open-sourced upon publication. Provide an artifact repository or a clear availability plan in the revision, especially because the correctness of Algorithm 1 and the ECT procedure can only be fully checked against the implementation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the storage reduction is measured empirically and the lossless guarantee is a design mechanism, not a hidden restatement of the claim.

full rationale

DEHYDRATOR's headline storage reduction (84.55%) is a direct measurement: Table II reports average graph size BPpre = 1598.69 MB and Table IV reports average BPpost = 247 MB for MMT + DNN + ECT, so the ratio is an empirical result, not a quantity derived from a fitted constant, a self-citation, or a uniqueness assumption. The error-correction table is constructed by testing the trained model against the exact dataset and recording every mismatch, which guarantees losslessness by construction; however, this is a system design property that makes the storage scheme exact, not a circular derivation of the compression claim. The only debatable step is the comparison with Leonard: the paper explicitly discloses that Leonard's 3592 MB ECT gzip-compresses to 68 MB and explains why it nevertheless counts the raw JSON size, citing decompression latency and memory costs. Whether that is the right fairness metric is a correctness or methodology concern, not a circularity. Self-citations ([43], [49]) appear only as background examples of attack-investigation workloads and are not load-bearing for the storage-efficiency argument. No equation in the paper reduces the claimed result to its own inputs, and no fitted parameter is renamed as a prediction.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The core mechanism is an engineering system; claims rest on dataset assumptions (faithful audit logs), query-model assumptions (reverse BFS), and a derived threshold for hierarchical encoding that contains a gap. No new physical entities are introduced.

free parameters (3)
  • Default model capacity (C2) = 70K parameters, embedding dimension 64, 2 attention heads, feedforward dimension 256
    Chosen as a compromise in Section IV-F to balance storage and latency; it directly affects ECT size and query speed, so the central numbers depend on this choice.
  • Segment length L = Adaptive per dataset; reported as 23 for the G1 ablation
    Section III-B2 says DEHYDRATOR derives the minimum length from the data and segments all strings accordingly. This is a data-dependent parameter, not a theoretical constant.
  • Training hyperparameters = Batch size 4096, Adam, learning rate 0.001, max 5 epochs with early stopping
    These are fixed defaults in Section IV-A, not fitted per dataset, but they influence model quality, ECT size, and training time.
assumptions (3)
  • domain assumption Audit logs and regex parsing yield a faithful provenance graph with exactly the node and edge fields in Table I.
    The lossless claim depends on the chosen fields being sufficient and correct. Section III-A introduces the regex-based parsing without formal validation against ground truth.
  • domain assumption Forensic analysis can be modeled as reverse breadth-first search with time constraints, so storing all incoming edges per node is the right query unit.
    Section II-B and Section III-B1 justify hierarchical encoding based on this backward-looking query pattern. If forward queries or arbitrary predicate queries dominate, the encoding may be less effective.
  • domain assumption Every field can be encoded as int4 without information loss, and the redundancy bounds sum of mvo <= 3n, sum of mvot <= m, and sum of pv <= m hold.
    Section IV-E uses these bounds in Eqs. (2)-(5) to argue that average degree >= 3 guarantees hierarchical encoding reduces storage. The bounds are plausible for provenance graphs but are not proven for arbitrary inputs, and the inequality as written contains a gap.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DEHYDRATOR: Enhancing Provenance Graph Storage via Hierarchical Encoding and Sequence Generation." pith.science (2026). https://pith.science/paper/5B7KRFML

@misc{pith2026250100446,
  author       = {Pith},
  title        = {Pith review of: DEHYDRATOR: Enhancing Provenance Graph Storage via Hierarchical Encoding and Sequence Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5B7KRFML}},
  note         = {Machine review of arXiv:2501.00446}
}
read the original abstract

As the scope and impact of cyber threats have expanded, analysts utilize audit logs to hunt threats and investigate attacks. The provenance graphs constructed from kernel logs are increasingly considered as an ideal data source due to their powerful semantic expression and attack historic correlation ability. However, storing provenance graphs with traditional databases faces the challenge of high storage overhead, given the high frequency of kernel events and the persistence of attacks. To address this, we propose Dehydrator, an efficient provenance graph storage system. For the logs generated by auditing frameworks, Dehydrator uses field mapping encoding to filter field-level redundancy, hierarchical encoding to filter structure-level redundancy, and finally learns a deep neural network to support batch querying. We have conducted evaluations on seven datasets totaling over one billion log entries. Experimental results show that Dehydrator reduces the storage space by 84.55%. Dehydrator is 7.36 times more efficient than PostgreSQL, 7.16 times than Neo4j, and 16.17 times than Leonard (the work most closely related to Dehydrator, published at Usenix Security'23).

Figures

Figures reproduced from arXiv: 2501.00446 by the authors.

Figure 1
Figure 1. Overview of DEHYDRATOR TABLE I: Fields in node and edge tables and their correspond￾ing examples and styles. Table Field Example Style Node IdentiID F487A907 Unique Name Imapd Repetitive Type File/Process/Socket Repetitive Edge SrcID A603443D Unique DstID 388D98ED Unique TimeStamp 1522706865 Incremental Operation Read/Write/Execute Sendto/Recvfr/FORk Repetitive Hierarchical Encoding, and (2) Model Training. The form… view at source ↗
Figure 2
Figure 2. Hierarchical Encoding. analysis components. The function MergeEdges combines all edges into a nested list MergedEdge, as shown in Part C of [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Storage Overhead and time costs of Individual Com [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: (b), when the MC increases, both storage overhead BSpre −BSpost and latency Ts rise, with the latter increasing at a faster rate. As depicted in [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

92 extracted references · 59 canonical work pages

  1. [1]

    Global data breaches and cyber attacks in 2024,

    “Global data breaches and cyber attacks in 2024,” 2024, https:// www.itgovernance.co.uk/blog/global-data-breaches-and-cyber-attacks- in-2024#top-stats

    2024

  2. [2]

    Mother of all breaches reveals 26 billion records: what we know so far,

    “Mother of all breaches reveals 26 billion records: what we know so far,” 2024, https://cybernews .com/security/billions- passwords- credentials- leaked-mother-of-all- \breaches/

    2024

  3. [3]

    India-linked hackers target pakistan with spyware in new campaign

    “India-linked hackers target pakistan with spyware in new campaign.” 2024, https://therecord .media/india- linked- hackers- target- pakistan- with-spyware

    2024

  4. [4]

    Poland says russian cyberspies targeted government networks,

    “Poland says russian cyberspies targeted government networks,” 2024, https://www .reuters.com/technology/cybersecurity/poland-says-it-was- targeted-by-hacking-attack-russia- \linked-group-apt28-2024-05-08/

    2024

  5. [5]

    Cyberattack on indonesia’s national data centre paralyses government services,

    “Cyberattack on indonesia’s national data centre paralyses government services,” 2024, https://govinsider .asia/intl- en/article/cyberattack- on- indonesias-national-data-centre-paraly \-ses-government-services

    2024

  6. [6]

    “Groups,” https://attack .mitre.org/groups/

  7. [7]

    Sok: History is a vast early warning system: Auditing the provenance of system intrusions,

    M. A. Inam, Y . Chen, A. Goyal, J. Liu, J. Mink, N. Michael, S. Gaur, A. Bates, and W. U. Hassan, “Sok: History is a vast early warning system: Auditing the provenance of system intrusions,” in 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 2023, pp. 2620–2638

    2023

  8. [8]

    Jaeger, Operating system security

    T. Jaeger, Operating system security . Springer Nature, 2022

    2022

Show all 92 references
  1. [9]

    Computer security technology planning study,

    J. P. Anderson et al. , “Computer security technology planning study,” Citeseer, Tech. Rep., 1972

    1972

  2. [10]

    Perspectives on protection and security,

    B. Lampson, “Perspectives on protection and security,” in SOSP History Day 2015 , ser. SOSP ’15. New York, NY , USA: Association for Computing Machinery, 2015. [Online]. Available: https://doi.org/10.1145/2830903.2830905

    2015

  3. [11]

    Integrating ids alert correlation and os-level dependency tracking,

    Y . Zhai, P. Ning, and J. Xu, “Integrating ids alert correlation and os-level dependency tracking,” in Intelligence and Security Informatics: IEEE International Conference on Intelligence and Security Informatics, ISI 2006, San Diego, CA, USA, May 23-24, 2006. Proceedings 4 . ...

    2006

  4. [12]

    Bothunter: Detecting malware infection through ids-driven dialog cor- relation

    G. Gu, P. A. Porras, V . Yegneswaran, M. W. Fong, and W. Lee, “Bothunter: Detecting malware infection through ids-driven dialog cor- relation.” in USENIX Security Symposium , vol. 7, 2007, pp. 1–16

    2007

  5. [13]

    This is why we can’t cache nice things: Lightning- fast threat hunting using suspicion-based hierarchical storage,

    W. U. Hassan, D. Li, K. Jee, X. Yu, K. Zou, D. Wang, Z. Chen, Z. Li, J. Rhee, J. Gui et al., “This is why we can’t cache nice things: Lightning- fast threat hunting using suspicion-based hierarchical storage,” in Pro- ceedings of the 36th Annual Computer Security Applications ...

    2020

  6. [14]

    {CLARION}: Sound and clear provenance tracking for microservice deployments,

    X. Chen, H. Irshad, Y . Chen, A. Gehani, and V . Yegneswaran, “{CLARION}: Sound and clear provenance tracking for microservice deployments,” in 30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 3989–4006

    2021

  7. [15]

    {ALASTOR}: Reconstructing the provenance of serverless intrusions,

    P. Datta, I. Polinsky, M. A. Inam, A. Bates, and W. Enck, “{ALASTOR}: Reconstructing the provenance of serverless intrusions,” in 31st USENIX Security Symposium (USENIX Security 22) , 2022, pp. 2443–2460

    2022

  8. [16]

    Threat detection and investigation with system-level provenance graphs: A survey,

    Z. Li, Q. A. Chen, R. Yang, Y . Chen, and W. Ruan, “Threat detection and investigation with system-level provenance graphs: A survey,” Computers & Security , vol. 106, p. 102282, 2021

    2021

  9. [17]

    Holmes: real-time apt detection through correlation of suspicious information flows,

    S. M. Milajerdi, R. Gjomemo, B. Eshete, R. Sekar, and V . Venkatakrish- nan, “Holmes: real-time apt detection through correlation of suspicious information flows,” in 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 1137–1152

    2019

  10. [18]

    Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting,

    S. M. Milajerdi, B. Eshete, R. Gjomemo, and V . Venkatakrishnan, “Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting,” in Proceedings of the 2019 ACM SIGSAC conference on computer and communications security , 2019, pp. 1795–1812

    2019

  11. [19]

    You are what you do: Hunting stealthy malware via data provenance analysis

    Q. Wang, W. U. Hassan, D. Li, K. Jee, X. Yu, K. Zou, J. Rhee, Z. Chen, W. Cheng, C. A. Gunter et al., “You are what you do: Hunting stealthy malware via data provenance analysis.” in NDSS, 2020

    2020

  12. [20]

    Trace: Enterprise-wide provenance tracking for real-time apt detection,

    H. Irshad, G. Ciocarlie, A. Gehani, V . Yegneswaran, K. H. Lee, J. Patel, S. Jha, Y . Kwon, D. Xu, and X. Zhang, “Trace: Enterprise-wide provenance tracking for real-time apt detection,” IEEE Transactions on Information Forensics and Security , vol. 16, pp. 4363–4376, 2021

    2021

  13. [22]

    Nodoze: Combatting threat alert fatigue with automated provenance triage,

    W. U. Hassan, S. Guo, D. Li, Z. Chen, K. Jee, Z. Li, and A. Bates, “Nodoze: Combatting threat alert fatigue with automated provenance triage,” in network and distributed systems security symposium , 2019

    2019

  14. [23]

    Securing provenance-based audits,

    R. Aldeco-P ´erez and L. Moreau, “Securing provenance-based audits,” in International Provenance and Annotation Workshop . Springer, 2010, pp. 148–164

    2010

  15. [24]

    Validating the integrity of audit logs against execution reparti- tioning attacks,

    C. Yagemann, M. A. Noureddine, W. U. Hassan, S. Chung, A. Bates, and W. Lee, “Validating the integrity of audit logs against execution reparti- tioning attacks,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security , 2021, pp. 3337–3351

    2021

  16. [25]

    {Kernel-Supported}{Cost- Effective} audit logging for causality tracking,

    S. Ma, J. Zhai, Y . Kwon, K. H. Lee, X. Zhang, G. Ciocarlie, A. Gehani, V . Yegneswaran, D. Xu, and S. Jha, “ {Kernel-Supported}{Cost- Effective} audit logging for causality tracking,” in 2018 USENIX Annual Technical Conference (USENIX ATC 18) , 2018, pp. 241–254

    2018

  17. [26]

    Trustworthy {Whole- System} provenance for the linux kernel,

    A. Bates, D. J. Tian, K. R. Butler, and T. Moyer, “Trustworthy {Whole- System} provenance for the linux kernel,” in 24th USENIX Security Symposium (USENIX Security 15) , 2015, pp. 319–334

    2015

  18. [27]

    Trustwave global security report,

    Trustwave, “Trustwave global security report,” 2015

    2015

  19. [28]

    Loggc: garbage collecting audit log,

    K. H. Lee, X. Zhang, and D. Xu, “Loggc: garbage collecting audit log,” in Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, 2013, pp. 1005–1016

    2013

  20. [29]

    High fidelity data reduction for big data security dependency analyses,

    Z. Xu, Z. Wu, Z. Li, K. Jee, J. Rhee, X. Xiao, F. Xu, H. Wang, and G. Jiang, “High fidelity data reduction for big data security dependency analyses,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , 2016, pp. 504–516

    2016

  21. [30]

    Nodemerge: Template based efficient data reduction for big-data causality analysis,

    Y . Tang, D. Li, Z. Li, M. Zhang, K. Jee, X. Xiao, Z. Wu, J. Rhee, F. Xu, and Q. Li, “Nodemerge: Template based efficient data reduction for big-data causality analysis,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security , 2018, pp. 1324–1337

    2018

  22. [31]

    {Dependence- Preserving} data compaction for scalable forensic analysis,

    M. N. Hossain, J. Wang, O. Weisse, R. Sekar, D. Genkin, B. He, S. D. Stoller, G. Fang, F. Piessens, E. Downing et al. , “ {Dependence- Preserving} data compaction for scalable forensic analysis,” in 27th USENIX Security Symposium (USENIX Security 18) , 2018, pp. 1723– 1740

    2018

  23. [32]

    Gzip file format specification version 4.3,

    P. Deutsch, “Gzip file format specification version 4.3,” Tech. Rep., 1996

    1996

  24. [33]

    Deepzip: Lossless data compression using recurrent neural networks,

    M. Goyal, K. Tatwawadi, S. Chandak, and I. Ochoa, “Deepzip: Lossless data compression using recurrent neural networks,” arXiv preprint arXiv:1811.08162, 2018

    2018 arXiv

  25. [34]

    Neo4j graph database,

    “Neo4j graph database,” https://neo4j .com/

  26. [35]

    Orientdb,

    “Orientdb,” https://orientdb .org/

  27. [36]

    Titan graph database,

    “Titan graph database,” http://titan .thinkaurelius.com/

  28. [37]

    {SEAL}: Storage- efficient causality analysis on enterprise logs with query-friendly com- pression,

    P. Fei, Z. Li, Z. Wang, X. Yu, D. Li, and K. Jee, “ {SEAL}: Storage- efficient causality analysis on enterprise logs with query-friendly com- pression,” in 30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 2987–3004

    2021

  29. [38]

    {SLEUTH}: Real- time attack scenario reconstruction from {COTS} audit data,

    M. N. Hossain, S. M. Milajerdi, J. Wang, B. Eshete, R. Gjomemo, R. Sekar, S. Stoller, and V . Venkatakrishnan, “ {SLEUTH}: Real- time attack scenario reconstruction from {COTS} audit data,” in 26th USENIX Security Symposium (USENIX Security 17), 2017, pp. 487–504

    2017

  30. [39]

    {ELISE}: A storage efficient logging system powered by redundancy reduction and representation learning,

    H. Ding, S. Yan, J. Zhai, and S. Ma, “ {ELISE}: A storage efficient logging system powered by redundancy reduction and representation learning,” in 30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 3023–3040

    2021

  31. [40]

    The case for learned provenance graph storage systems,

    H. Ding, J. Zhai, D. Deng, and S. Ma, “The case for learned provenance graph storage systems,” in 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 3277–3294

    2023

  32. [41]

    Kairos:: Practical intrusion detection and investigation using whole- system provenance,

    Z. Cheng, Q. Lv, J. Liang, Y . Wang, D. Sun, T. Pasquier, and X. Han, “Kairos:: Practical intrusion detection and investigation using whole- system provenance,” arXiv preprint arXiv:2308.05034 , 2023. IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY , VOL. XX, NO. YY , ...

    2023 arXiv

  33. [42]

    Backtracking intrusions,

    S. T. King and P. M. Chen, “Backtracking intrusions,” in Proceedings of the nineteenth ACM symposium on Operating systems principles , 2003, pp. 223–236

    2003

  34. [43]

    Aptshield: A stable, efficient and real-time apt detection system for linux hosts,

    T. Zhu, J. Yu, C. Xiong, W. Cheng, Q. Yuan, J. Ying, T. Chen, J. Zhang, M. Lv, Y . Chen et al., “Aptshield: A stable, efficient and real-time apt detection system for linux hosts,” IEEE Transactions on Dependable and Secure Computing , 2023

    2023

  35. [44]

    {PROGRAPHER}: An anomaly detection system based on provenance graph embedding,

    F. Yang, J. Xu, C. Xiong, Z. Li, and K. Zhang, “ {PROGRAPHER}: An anomaly detection system based on provenance graph embedding,” in 32nd USENIX Security Symposium (USENIX Security 23) , 2023, pp. 4355–4372

    2023

  36. [45]

    Darap3 transparent engagement 3,

    “Darap3 transparent engagement 3,” 2023, https://drive .google.com/ drive/folders/1QlbUFW AGq3Hpl8wVdzOdIoZLFxkII4EK

    2023

  37. [46]

    Tactical provenance analysis for endpoint detection and response systems,

    W. U. Hassan, A. Bates, and D. Marino, “Tactical provenance analysis for endpoint detection and response systems,” in 2020 IEEE Symposium on Security and Privacy (SP) . IEEE, 2020, pp. 1172–1189

    2020

  38. [47]

    Depcomm: Graph summarization on system audit logs for attack investigation,

    Z. Xu, P. Fang, C. Liu, X. Xiao, Y . Wen, and D. Meng, “Depcomm: Graph summarization on system audit logs for attack investigation,” in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 540–557

    2022

  39. [48]

    {Back-Propagating} system dependency impact for attack investigation,

    P. Fang, P. Gao, C. Liu, E. Ayday, K. Jee, T. Wang, Y . F. Ye, Z. Liu, and X. Xiao, “{Back-Propagating} system dependency impact for attack investigation,” in 31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 2461–2478

    2022

  40. [49]

    Conan: A practical real-time apt detection system with high accuracy and efficiency,

    C. Xiong, T. Zhu, W. Dong, L. Ruan, R. Yang, Y . Cheng, Y . Chen, S. Cheng, and X. Chen, “Conan: A practical real-time apt detection system with high accuracy and efficiency,” IEEE Transactions on Dependable and Secure Computing , vol. 19, no. 1, pp. 551–565, 2020

    2020

  41. [50]

    Combating dependence ex- plosion in forensic analysis using alternative tag propagation semantics,

    M. N. Hossain, S. Sheikhi, and R. Sekar, “Combating dependence ex- plosion in forensic analysis using alternative tag propagation semantics,” in 2020 IEEE Symposium on Security and Privacy (SP) . IEEE, 2020, pp. 1139–1155

    2020

  42. [51]

    Deepsqueeze: Deep semantic compression for tabular data,

    A. Ilkhechi, A. Crotty, A. Galakatos, Y . Mao, G. Fan, X. Shi, and U. Cetintemel, “Deepsqueeze: Deep semantic compression for tabular data,” in Proceedings of the 2020 ACM SIGMOD international confer- ence on management of data , 2020, pp. 1733–1746

    2020

  43. [52]

    C-store: a column-oriented dbms,

    M. Stonebraker, D. J. Abadi, A. Batkin, X. Chen, M. Cherniack, M. Ferreira, E. Lau, A. Lin, S. Madden, E. O’Neil et al. , “C-store: a column-oriented dbms,” in Making Databases Work: the Pragmatic Wisdom of Michael Stonebraker , 2018, pp. 491–518

    2018

  44. [53]

    The vertica analytic database: C-store 7 years later,

    A. Lamb, M. Fuller, R. Varadarajan, N. Tran, B. Vandier, L. Doshi, and C. Bear, “The vertica analytic database: C-store 7 years later,” arXiv preprint arXiv:1208.4173, 2012

    2012 arXiv

  45. [54]

    Event tracing,

    “Event tracing,” https://docs .microsoft.com/en- us/windows/desktop/ ETW/event-tracing-portal

  46. [55]

    System administration utilities,

    “System administration utilities,” https://man7 .org/linux/man- pages/ man8/auditd.8.html

  47. [56]

    Dtrace on freebsd,

    “Dtrace on freebsd,” https : / / man7 .org / linux / man - pages / man8 / auditd.8.html

  48. [57]

    The linux audit framework,

    “The linux audit framework,” 2017, https://github .com/linux-audit/

    2017

  49. [58]

    A neural probabilistic language model,

    Y . Bengio, R. Ducharme, and P. Vincent, “A neural probabilistic language model,” Advances in neural information processing systems , vol. 13, 2000

    2000

  50. [59]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” Advances in neural information processing systems , vol. 30, 2017

    2017

  51. [60]

    Efficient estimation of word representations in vector space,

    T. Mikolov, K. Chen, G. Corrado, and J. Dean, “Efficient estimation of word representations in vector space,” arXiv preprint arXiv:1301.3781 , 2013

    2013 arXiv

  52. [61]

    Xlnet: Generalized autoregressive pretraining for language understanding,

    Z. Yang, Z. Dai, Y . Yang, J. Carbonell, R. R. Salakhutdinov, and Q. V . Le, “Xlnet: Generalized autoregressive pretraining for language understanding,” Advances in neural information processing systems , vol. 32, 2019

    2019

  53. [62]

    Improving language understanding by generative pre-training,

    A. Radford, K. Narasimhan, T. Salimans, I. Sutskever et al., “Improving language understanding by generative pre-training,” 2018

    2018

  54. [63]

    Parsing natural scenes and natural language with recursive neural networks,

    R. Socher, C. C. Lin, C. Manning, and A. Y . Ng, “Parsing natural scenes and natural language with recursive neural networks,” in Proceedings of the 28th international conference on machine learning (ICML-11), 2011, pp. 129–136

    2011

  55. [64]

    Long short-term memory,

    S. Hochreiter and J. Schmidhuber, “Long short-term memory,” Neural computation, vol. 9, no. 8, pp. 1735–1780, 1997

    1997

  56. [65]

    Empirical evaluation of gated recurrent neural networks on sequence modeling,

    J. Chung, C. Gulcehre, K. Cho, and Y . Bengio, “Empirical evaluation of gated recurrent neural networks on sequence modeling,” arXiv preprint arXiv:1412.3555, 2014

    2014 arXiv

  57. [66]

    Not all parameters are born equal: Attention is mostly what you need,

    N. Bogoychev, “Not all parameters are born equal: Attention is mostly what you need,” arXiv preprint arXiv:2010.11859 , 2020

    2010 arXiv

  58. [67]

    Bert: Pre-training of deep bidirectional transformers for language understanding,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” arXiv preprint arXiv:1810.04805, 2018

    2018 arXiv

  59. [68]

    Long range arena: A benchmark for efficient transformers,

    Y . Tay, M. Dehghani, S. Abnar, Y . Shen, D. Bahri, P. Pham, J. Rao, L. Yang, S. Ruder, and D. Metzler, “Long range arena: A benchmark for efficient transformers,” arXiv preprint arXiv:2011.04006 , 2020

    2011 arXiv

  60. [69]

    Fast transformer decoding: One write-head is all you need,

    N. Shazeer, “Fast transformer decoding: One write-head is all you need,” arXiv preprint arXiv:1911.02150 , 2019

    1911 arXiv

  61. [70]

    A joint model for word embedding and word morphology,

    K. Cao and M. Rei, “A joint model for word embedding and word morphology,” arXiv preprint arXiv:1606.02601 , 2016

    2016 arXiv

  62. [71]

    Postgresql: The world’s most advanced open source relational database,

    “Postgresql: The world’s most advanced open source relational database,” 2024, https://www .postgresql.org/

    2024

  63. [72]

    Spade: Support for provenance auditing in distributed environments,

    A. Gehani and D. Tariq, “Spade: Support for provenance auditing in distributed environments,” in ACM/IFIP/USENIX Int. Middleware Conf., MIDDLEWARE. Springer, 2012, pp. 101–120

    2012

  64. [73]

    “Sysdig,” 2023, https://github .com/draios/sysdig

    2023

  65. [74]

    Postgresql copy command,

    “Postgresql copy command,” 2024, https://www .postgresql.org/docs/ current/sql-copy.html

    2024

  66. [75]

    Neo4j-admin import,

    “Neo4j-admin import,” 2024, https://neo4j .com/docs/operations-manual/ current/tutorial/neo4j-admin-import/

    2024

  67. [76]

    Neural tangent kernel: Con- vergence and generalization in neural networks,

    A. Jacot, F. Gabriel, and C. Hongler, “Neural tangent kernel: Con- vergence and generalization in neural networks,” Advances in neural information processing systems , vol. 31, 2018

    2018

  68. [77]

    Understanding and improving transformer from a multi-particle dynamic system point of view,

    Y . Lu, Z. Li, D. He, Z. Sun, B. Dong, T. Qin, L. Wang, and T.-Y . Liu, “Understanding and improving transformer from a multi-particle dynamic system point of view,” arXiv preprint arXiv:1906.02762, 2019

    1906 arXiv

  69. [78]

    Shadewatcher: Recommendation-guided cyber threat analysis using system audit records,

    J. Zengy, X. Wang, J. Liu, Y . Chen, Z. Liang, T.-S. Chua, and Z. L. Chua, “Shadewatcher: Recommendation-guided cyber threat analysis using system audit records,” in 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, pp. 489–506

    2022

  70. [79]

    {ATLAS}: A sequence-based learning approach for attack investigation,

    A. Alsaheel, Y . Nan, S. Ma, L. Yu, G. Walkup, Z. B. Celik, X. Zhang, and D. Xu, “ {ATLAS}: A sequence-based learning approach for attack investigation,” in 30th USENIX security symposium (USENIX security 21), 2021, pp. 3005–3022

    2021

  71. [80]

    Fast decoding in sequence models using discrete latent variables,

    L. Kaiser, S. Bengio, A. Roy, A. Vaswani, N. Parmar, J. Uszkoreit, and N. Shazeer, “Fast decoding in sequence models using discrete latent variables,” in International Conference on Machine Learning . PMLR, 2018, pp. 2390–2399

    2018

  72. [81]

    Reconciling modern machine-learning practice and the classical bias–variance trade-off,

    M. Belkin, D. Hsu, S. Ma, and S. Mandal, “Reconciling modern machine-learning practice and the classical bias–variance trade-off,” Proceedings of the National Academy of Sciences , vol. 116, no. 32, pp. 15 849–15 854, 2019

    2019

  73. [82]

    Scaling description of generaliza- tion with number of parameters in deep learning,

    M. Geiger, A. Jacot, S. Spigler, F. Gabriel, L. Sagun, S. d’Ascoli, G. Biroli, C. Hongler, and M. Wyart, “Scaling description of generaliza- tion with number of parameters in deep learning,” Journal of Statistical Mechanics: Theory and Experiment , vol. 2020, no. 2, p. 023401, 2020

    2020

  74. [83]

    Deep double descent: Where bigger models and more data hurt,

    P. Nakkiran, G. Kaplun, Y . Bansal, T. Yang, B. Barak, and I. Sutskever, “Deep double descent: Where bigger models and more data hurt,” Journal of Statistical Mechanics: Theory and Experiment , vol. 2021, no. 12, p. 124003, 2021

    2021

  75. [84]

    Mitre attck,

    “Mitre attck,” 2019, https://attack .mitre.org

    2019

  76. [85]

    Threatrace: Detecting and tracing host-based threats in node level through provenance graph learning,

    S. Wang, Z. Wang, T. Zhou, H. Sun, X. Yin, D. Han, H. Zhang, X. Shi, and J. Yang, “Threatrace: Detecting and tracing host-based threats in node level through provenance graph learning,” IEEE Transactions on Information Forensics and Security , pp. 3972–3987, 2022

    2022

  77. [86]

    Unicorn: Runtime provenance-based detector for advanced persistent threats,

    X. Han, T. Pasquier, A. Bates, J. Mickens, and M. Seltzer, “Unicorn: Runtime provenance-based detector for advanced persistent threats,” arXiv preprint arXiv:2001.01525 , 2020

    2001 arXiv

  78. [87]

    Fast memory-efficient anomaly detection in streaming heterogeneous graphs,

    E. Manzoor, S. M. Milajerdi, and L. Akoglu, “Fast memory-efficient anomaly detection in streaming heterogeneous graphs,” in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , 2016, p. 1035–1044. [Online]. Available: https://doi...

    2016

  79. [88]

    Hercule: Attack story reconstruction via community discovery on correlated log graph,

    K. Pei et al. , “Hercule: Attack story reconstruction via community discovery on correlated log graph,” in ACSAC, 2016, pp. 583–595

    2016

  80. [89]

    Towards a timely causality analysis for enterprise security

    Y . Liu et al., “Towards a timely causality analysis for enterprise security.” in NDSS, 2018

    2018

  81. [90]

    Watson: Abstracting behaviors from audit logs via aggregation of contextual semantics

    J. Zeng et al. , “Watson: Abstracting behaviors from audit logs via aggregation of contextual semantics.” in NDSS, 2021

    2021

  82. [91]

    Compressing provenance graphs,

    Y . Xie, K.-K. Muniswamy-Reddy, D. D. Long, A. Amer, D. Feng, and Z. Tan, “Compressing provenance graphs,” in 3rd USENIX Workshop on the Theory and Practice of Provenance (TaPP 11) , 2011

    2011

  83. [92]

    A hybrid approach for efficient provenance storage,

    Y . Xie, D. Feng, Z. Tan, L. Chen, K.-K. Muniswamy-Reddy, Y . Li, and D. D. Long, “A hybrid approach for efficient provenance storage,” in Proceedings of the 21st ACM international conference on Information and knowledge management , 2012, pp. 1752–1756. IEEE TRANSACTIONS ON I...

    2012

  84. [93]

    Evaluation of a hybrid approach for efficient provenance storage,

    Y . Xie, K.-K. Muniswamy-Reddy, D. Feng, Y . Li, and D. D. Long, “Evaluation of a hybrid approach for efficient provenance storage,” ACM Transactions on Storage (TOS) , vol. 9, no. 4, pp. 1–29, 2013

    2013

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.