Provenance Graph Context Integration via System Call Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current graph construction methods for provenance graphs rely solely on low-level system-call data, limiting their ability to incorporate high-level context information and leading to issues like 'dependency explosion' and noise, making it difficult to effectively prune nodes and edges and enrich graphs with meaningful context.
Innovation Solution
Establishing a mapping from low-level system calls to user functions using binary analysis and machine learning, and employing a search algorithm to identify user functions that trigger system calls, enabling the integration of program-level context information into provenance graphs through a system-call-sequence embedding model and heuristic search methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If low-level system-call data is used to construct provenance graphs, then graph construction is straightforward and program-agnostic, but the graphs lack high-level context information and suffer from dependency explosion
Solution Approach 1:
The patent extracts only the relevant high-level context information needed for pruning decisions, rather than incorporating all possible program-level data. This selective extraction enriches the provenance graph with meaningful context while avoiding the inclusion of unnecessary nodes and edges that would cause dependency explosion.
Solution Approach 2:
The patent applies different levels of enrichment to different parts of the provenance graph based on local needs. High-level context information is integrated selectively at specific graph regions where it provides the most value for pruning decisions, rather than uniformly across the entire graph.
2Manufacturing precision
If high-level context information is incorporated to guide pruning, then pruning effectiveness improves, but program analysis complexity and runtime instrumentation requirements increase
Solution Approach 1:
The patent introduces an intermediary layer that translates high-level program context into pruning guidance without requiring full program analysis or runtime instrumentation. This intermediary mechanism bridges the gap between low-level system calls and high-level semantics, enabling accurate pruning through simplified program-level information.
Solution Approach 2:
The patent performs preliminary extraction of program-level context information before provenance graph construction, preparing pruning guidance in advance. This preliminary action enables more effective pruning during graph construction without adding complexity to the main graph building process.
3Loss of information
If mapping from system calls to user functions is established, then high-level context integration is enabled, but the complexity of establishing and maintaining the mapping increases
Solution Approach 1:
The patent creates a universal mapping mechanism that handles multiple system call types and user function categories through a unified approach. This multi-functional mapping system reduces the complexity of establishing and maintaining separate mappings for different system call categories while retaining comprehensive context information.
Data Source
AI summary
A computer-implemented method is provided for computer intrusion detection. The method includes establishing a mapping from low-level system calls to user functions in computer programs. The user functions run in a user space of an operating system. The method further includes identifying, using a search algorithm inputting the mapping and a system-call trace captured at runtime, any of the user functions that trigger the low-level system calls in the system-call trace. The method further includes performing, by a processor device, intrusion detection responsive to a provenance graph with program contexts. The provenance graph has nodes formed from the user functions that trigger the low-level system calls in the system-call trace. Edges in the provenance graph have edge labels describing high-level system operations for low-level system call to high-level system operation correlation-based intrusion detection.