TRACE: Enterprise-Wide Provenance Tracking for Real-Time APT Detection
Hassaan Irshada, Gabriela Felicia Ciocarlieb, Ashish Gehania, Vinod Yegneswarana, Kyu Hyoung Leec, Jignesh M. Pateld, Somesh Jhad, Yonghwi Kwone, Dongyan Xuf, Xiangyu Zhangf
- aSRI International, Menlo Park, CA, USA
- bDepartment of Electrical and Computer Engineering (ECE), The University of Texas, San Antonio, TX, USA
- cDepartment of Computer Science, University of Georgia (UGA), Athens, GA, USA
- dDepartment of Computer Sciences, University of Wisconsin–Madison, Madison, WI, USA
- eDepartment of Computer Science, University of Virginia, Charlottesville, VA, USA
- fDepartment of Computer Science, Purdue University, West Lafayette, IN, USA
Papers open inside SciRah from the original publisher or repository; SciRah never hosts them.
Abstract
We present TRACE, a comprehensive provenance tracking system for scalable, real-time, enterprise-wide APT detection. TRACE uses static analysis to identify program unit structures and inter-unit dependences, such that the provenance of an output event includes the input events within the same unit. Provenance collected from individual hosts are integrated to facilitate construction of a distributed enterprise-wide causal graph. We describe the evolution of TRACE over a four-year period, during which our improvements to the system focused on performance, scalability, and fidelity. In this time span, the system call coverage increased (from 47 to 66) while the time and space overhead reduced by over one and two orders of magnitude, respectively. We also provide results from five adversarial engagements where an independent team of system evaluators conducted APT attacks and assessed system performance. The input from our system was used by three other teams to implement real-time APT detection logic. Retrospective analysis revealed that TRACE provided sufficient evidence to detect over 80% of the attack stages across all evaluations. By the last engagement, temporal and spatial overhead had been reduced significantly to 18% and 10%, respectively.