ProvSec: Open Cybersecurity System Provenance Analysis Benchmark Dataset with Labels

Shrestha, Madhukar; Kim, Yonghyun; Oh, Jeehyun; Rhee, Junghwan; Choe, Yung Ryn; Zuo, Fei; Park, Myungah; Qian, Gang

doi:10.1007/s44227-023-00014-9

ProvSec: Open Cybersecurity System Provenance Analysis Benchmark Dataset with Labels

Journal Article · Tue Nov 14 23:00:00 EST 2023 · International Journal of Networked and Distributed Computing

DOI:https://doi.org/10.1007/s44227-023-00014-9· OSTI ID:2311396

Shrestha, Madhukar ^[1]; Kim, Yonghyun ^[1]; Oh, Jeehyun ^[1]; ^[1]; Choe, Yung Ryn ^[2]; Zuo, Fei ^[1]; Park, Myungah ^[1]; Qian, Gang ^[1]

Univ. of Central Oklahoma, Edmond, OK (United States)
Sandia National Laboratories (SNL-CA), Livermore, CA (United States)

System provenance forensic analysis has been studied by a large body of research work. This area needs fine granularity data such as system calls along with event fields to track the dependencies of events. While prior work on security datasets has been proposed, we found a useful dataset of realistic attacks and details that are needed for high-quality provenance tracking is lacking. We created a new dataset of eleven vulnerable cases for system forensic analysis. It includes the full details of system calls including syscall parameters. Realistic attack scenarios with real software vulnerabilities and exploits are used. For each case, we created two sets of benign and adversary scenarios which are manually labeled for supervised machine-learning analysis. In addition, we present an algorithm to improve the data quality in the system provenance forensic analysis. We demonstrate the details of the dataset events and dependency analysis of our dataset cases.

View Accepted Manuscript (DOE)

Research Organization:: Sandia National Laboratories (SNL-CA), Livermore, CA (United States)

Sponsoring Organization:: USDOE National Nuclear Security Administration (NNSA); US Department of Homeland Security (DHS)

Grant/Contract Number:: NA0003525

OSTI ID:: 2311396

Report Number(s):: SAND--2023-13731J

Journal Information:: International Journal of Networked and Distributed Computing, Journal Name: International Journal of Networked and Distributed Computing Journal Issue: 2 Vol. 11; ISSN 2211-7938

Publisher:: International Association of Computer and Information Science (ACIS)Copyright Statement

Country of Publication:: United States

Language:: English

References (33)

Some Software Vulnerability Real-World Data Sets Nguyen, Van https://doi.org/10.21227/1m98-5h52	dataset	January 2021
Data Sources and Datasets for Cloud Intrusion Detection Modeling and Evaluation Aldribi, Abdulaziz; Traore, Issa; Moa, Belaid Studies in Big Data https://doi.org/10.1007/978-3-319-73676-1_13	book	January 2018
SPADE: Support for Provenance Auditing in Distributed Environments Gehani, Ashish; Tariq, Dawood Lecture Notes in Computer Science https://doi.org/10.1007/978-3-642-35170-9_6	book	January 2012
Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset Koroniotis, Nickolaos; Moustafa, Nour; Sitnikova, Elena Future Generation Computer Systems, Vol. 100 https://doi.org/10.1016/j.future.2019.05.041	journal	November 2019
A detailed analysis of the KDD CUP 99 data set Tavallaee, Mahbod; Bagheri, Ebrahim; Lu, Wei 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA) https://doi.org/10.1109/CISDA.2009.5356528	conference	July 2009
Detecting Malware Injection with Program-DNS Behavior Sun, Yixin; Jee, Kangkook; Sivakorn, Suphannee 2020 IEEE European Symposium on Security and Privacy (EuroS&P) https://doi.org/10.1109/EuroSP48549.2020.00042	conference	September 2020
HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows Milajerdi, Sadegh M.; Gjomemo, Rigel; Eshete, Birhanu 2019 IEEE Symposium on Security and Privacy (SP) https://doi.org/10.1109/SP.2019.00026	conference	May 2019
Combating Dependence Explosion in Forensic Analysis Using Alternative Tag Propagation Semantics Hossain, Md Nahid; Sheikhi, Sanaz; Sekar, R. 2020 IEEE Symposium on Security and Privacy (SP) https://doi.org/10.1109/SP40000.2020.00064	conference	May 2020
Tactical Provenance Analysis for Endpoint Detection and Response Systems Hassan, Wajih Ul; Bates, Adam; Marino, Daniel 2020 IEEE Symposium on Security and Privacy (SP) https://doi.org/10.1109/SP40000.2020.00096	conference	May 2020
SoK: History is a Vast Early Warning System: Auditing the Provenance of System Intrusions Inam, Muhammad Adil; Chen, Yinfang; Goyal, Akul 2023 IEEE Symposium on Security and Privacy (SP) https://doi.org/10.1109/SP46215.2023.10179405	conference	May 2023
Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance Cheng, Zijun; Lv, Qiujian; Liang, Jinyuan 2024 IEEE Symposium on Security and Privacy (SP) https://doi.org/10.1109/SP54263.2024.00005	conference	May 2024
Camflow: Managed Data-Sharing for Cloud Services Pasquier, Thomas F. J. -M.; Singh, Jatinder; Eyers, David IEEE Transactions on Cloud Computing, Vol. 5, Issue 3 https://doi.org/10.1109/TCC.2015.2489211	journal	July 2017
LogGC Lee, Kyu Hyung; Zhang, Xiangyu; Xu, Dongyan Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security - CCS '13 https://doi.org/10.1145/2508859.2516731	conference	January 2013
Accurate, Low Cost and Instrumentation-Free Security Audit Logging for Windows Ma, Shiqing; Lee, Kyu Hyung; Kim, Chung Hwan Proceedings of the 31st Annual Computer Security Applications Conference https://doi.org/10.1145/2818000.2818039	conference	December 2015
High Fidelity Data Reduction for Big Data Security Dependency Analyses Xu, Zhang; Wu, Zhenyu; Li, Zhichun Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security https://doi.org/10.1145/2976749.2978378	conference	October 2016
Millions of targets under attack Jonker, Mattijs; King, Alistair; Krupp, Johannes Proceedings of the 2017 Internet Measurement Conference https://doi.org/10.1145/3131365.3131383	conference	November 2017
VulinOSS Gkortzis, Antonios; Mitropoulos, Dimitris; Spinellis, Diomidis Proceedings of the 15th International Conference on Mining Software Repositories https://doi.org/10.1145/3196398.3196454	conference	May 2018
NodeMerge Tang, Yutao; Li, Ding; Li, Zhichun Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security https://doi.org/10.1145/3243734.3243763	conference	October 2018
This is Why We Can’t Cache Nice Things: Lightning-Fast Threat Hunting using Suspicion-Based Hierarchical Storage Hassan, Wajih Ul; Li, Ding; Jee, Kangkook Annual Computer Security Applications Conference https://doi.org/10.1145/3427228.3427255	conference	December 2020
On the Forensic Validity of Approximated Audit Logs Michael, Noor; Mink, Jaron; Liu, Jason Annual Computer Security Applications Conference https://doi.org/10.1145/3427228.3427272	conference	December 2020
Analyzing the Usefulness of the DARPA OpTC Dataset in Cyber Threat Detection Research Anjum, Md. Monowar; Iqbal, Shahrear; Hamelin, Benoit Proceedings of the 26th ACM Symposium on Access Control Models and Technologies https://doi.org/10.1145/3450569.3463573	conference	June 2021
Provenance-based Intrusion Detection Systems: A Survey Zipperle, Michael; Gottwalt, Florian; Chang, Elizabeth ACM Computing Surveys, Vol. 55, Issue 7 https://doi.org/10.1145/3539605	journal	December 2022
PalanTír Zeng, Jun; Zhang, Chuqi; Liang, Zhenkai Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security https://doi.org/10.1145/3548606.3560570	conference	November 2022
A Comprehensive Dataset Towards Hands-on Experience Enhancement in a Research-Involved Cybersecurity Program Zuo, Fei; Rhee, Junghwan; Kim, Yonghyun The 24th Annual Conference on Information Technology Education https://doi.org/10.1145/3585059.3611416	conference	October 2023
Data Provenance in Security and Privacy Pan, Bofeng; Stakhanova, Natalia; Ray, Suprio ACM Computing Surveys, Vol. 55, Issue 14s https://doi.org/10.1145/3593294	journal	July 2023
Backtracking intrusions King, Samuel T.; Chen, Peter M. Proceedings of the nineteenth ACM symposium on Operating systems principles https://doi.org/10.1145/945445.945467	conference	October 2003
Detecting Malicious DNS over HTTPS Traffic in Domain Name System using Machine Learning Classifiers M. Banadaki, Yaser Journal of Computer Sciences and Applications, Vol. 8, Issue 2 https://doi.org/10.12691/jcsa-8-2-2	journal	August 2020
ProTracer: Towards Practical Provenance Tracing by Alternating Between Logging and Tainting Ma, Shiqing; Zhang, Xiangyu; Xu, Dongyan Proceedings 2016 Network and Distributed System Security Symposium https://doi.org/10.14722/ndss.2016.23350	conference	January 2016
Towards Scalable Cluster Auditing through Grammatical Inference over Provenance Graphs Hassan, Wajih Ul; Lemay, Mark; Aguse, Nuraini Proceedings 2018 Network and Distributed System Security Symposium https://doi.org/10.14722/ndss.2018.23141	conference	January 2018
Towards a Timely Causality Analysis for Enterprise Security Liu, Yushan; Zhang, Mu; Li, Ding Proceedings 2018 Network and Distributed System Security Symposium https://doi.org/10.14722/ndss.2018.23254	conference	January 2018
NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage Hassan, Wajih Ul; Guo, Shengjian; Li, Ding Proceedings 2019 Network and Distributed System Security Symposium https://doi.org/10.14722/ndss.2019.23349	conference	January 2019
You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis Wang, Qi; Hassan, Wajih Ul; Li, Ding Proceedings 2020 Network and Distributed System Security Symposium https://doi.org/10.14722/ndss.2020.24167	conference	January 2020
Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization Sharafaldin, Iman; Habibi Lashkari, Arash; Ghorbani, Ali A. Proceedings of the 4th International Conference on Information Systems Security and Privacy https://doi.org/10.5220/0006639801080116	conference	January 2018

Similar Records

Hybrid Attack Graph Generation with Graph Convolutional Deep-Q Learning

Conference · Sat Dec 30 23:00:00 EST 2023 · OSTI ID:2336568

Cyber Attack Sequences Generation for Electric Power Grid

Conference · Tue May 03 00:00:00 EDT 2022 · OSTI ID:1872531

Trends in Cybersecurity Threats to Clean Energy

Conference · Wed Jun 12 00:00:00 EDT 2024 · OSTI ID:2373116

Related Subjects

97 MATHEMATICS AND COMPUTING
Attack
Backtracking
Dataset
Provenance

ProvSec: Open Cybersecurity System Provenance Analysis Benchmark Dataset with Labels

Citation Formats

References (33)

Similar Records

Related Subjects