WIPP - Towards a Delay-Sensitive Provenance Framework for Operational Technology Networks

In the rapidly advancing age of cybersecurity, detecting and mitigating advanced cyber threats is a critical challenge. This work-in-progress paper (WIPP) explores the use of low-level system log auditing for effective threat detection, focusing on the innovative use of provenance-based techniques. We focus our attention on three advanced systems —ShadeWatcher, SPADE, and UNICORN, which leverage data provenance to enhance cyber-threat detection capabilities. By analyzing their methods and integrating their strengths, we propose a delay-sensitive audit tracking system suitable for critical infrastructure networks. Our system aims to detect anomalous activities with high precision and reduce false alarms within a guaranteed time bound, thus providing robust protection against cyber threats.