CP2GS: Cross-Platform Provenance Generation System

Provenance graphs offer significant advantages and potential in detecting multi-step complex network attacks, but the field currently has limited research on the construction of provenance graphs, necessitating a cross-platform, universal, and convenient system for building provenance graphs. Addressing this issue, this paper proposes a cross-platform software system named CP2GS, which is designed to parse system audit logs and generate provenance data. CP2GS can effectively reduce the operational complexity caused by data differences across platforms. Furthermore, the system implements a customized version control strategy and saves space by reducing unnecessary version nodes. This paper also provides specific details on the extraction and parsing of data sources to advance related research. Experiments have demonstrated that CP2GS can accurately and in real-time construct provenance graphs across platforms, and can be effectively applied to intrusion detection and forensic investigation of complex attacks.