Abstract:The provenance graph technique has gained popularity for attack analysis, such as Advanced Persistent Threat (APT) attacks, by creating entity interaction graphs from host audit logs. While this method has shown promising analysis results and interpretability, its robustness against mimic attacks carried out by potentially skilled attackers has yet to be fully proven. Recent research has showcased adversarial methodologies targeting provenance-based Machine Learning (ML) detectors, leading to evasion attacks through the addition of corresponding nodes and edges to the feature space. However, these approaches face several challenges, including the difficulty in translating feature alterations into practical attack scenarios and limited applicability to other provenance graph-based detection schemes. In this study, we propose the Provenance-based Attack Investigation Obfuscation Framework(PAIOF), which proposes a novel obfuscation attack for the existing provenance-based forensic investigation system and demonstrates it needs to be extended and upgraded. More specifically, by thoughtfully analyzing key indicators from three classic provenance-based investigation approaches to set obfuscation goals. We establish an end-to-end mapping relationship between system operational behaviors and provenance graphs and create obfuscation programs guided by obfuscation goals to generate real attack instances. Our experiments demonstrate that our obfuscation scheme significantly reduces both the recall and precision of current state-of-the-art schemes in the DARPA Transparent Computing (TC) dataset and in simulated real-world attack scenarios. Furthermore, the meta-behavioral modeling approach of our system ensures its applicability in real-world scenarios, while we also discuss potential defenses against such attacks.

A Hypervisor Level Provenance System to Reconstruct Attack Story Caused by Kernel Malware.

HProve: A Hypervisor Level Provenance System to Reconstruct Attack Story Caused by Kernel Malware.

You Are What You Do: Hunting Stealthy Malware Via Data Provenance Analysis

Unifying Intrusion Detection and Forensic Analysis Via Provenance Awareness

Obfuscating Provenance-Based Forensic Investigations with Mapping System Meta-Behavior

threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learning

Prov2vec: Learning Provenance Graph Representation for Unsupervised APT Detection

Transparency and Semantics Coexist: When Malware Analysis Meets the Hardware Assisted Virtualization

Threat detection and investigation with system-level provenance graphs: A survey

Using An In-Kernel Hypervisor To Protect The Integrity Of Operating System

Transparent Protection of Commodity OS Kernels Using Hardware Virtualization

Retrofitting LBR Profiling to Enhance Virtual Machine Introspection

Kairos: Practical Intrusion Detection and Investigation Using Whole-system Provenance

Kernel Malware Core Implementation: A Survey

Exception-Oriented Programming: Retrofitting Code-Reuse Attacks to Construct Kernel Malware

Detecting Compromised Kernel Hooks with Support of Hardware Debugging Features

Holography: a Behavior-Based Profiler for Malware Analysis

PrivGuard: Protecting Sensitive Kernel Data from Privilege Escalation Attacks

Provenance-based Intrusion Detection: Opportunities and Challenges

Practical Protection of Kernel Integrity for Commodity OS from Untrusted Extensions.

Efficient Monitoring and Forensic Analysis Via Accurate Network-Attached Provenance Collection with Minimal Storage Overhead