ProvNavigator: shadow path guided attack investigation method

After cyber attacks, conducting an investigation to analyze its root cause and impact is crucial. Currently, provenance graph-based techniques have become mainstream methods, but these methods face the challenge of dependency explosion problems. Recent research has alleviated this issue to some extent by integrating audit logs and application logs, showcasing advantages such as no need for program instrumentation, model training, or taint analysis. However, existing log fusion techniques either rely on complex fusion rules or require reverse engineering of applications, necessitating algorithm adjustments when facing new applications, which limits their general applicability. To address these issues, a new log fusion-based attack investigation method, ProvNavigator, was proposed. In the graph construction phase, individual provenance graphs from different log sources were merged into a global fused provenance graph by analyzing correlations between logs. In the attack investigation phase, nodes with dependency explosion were handled through “shadow path pairs,” and appropriate edges were selected to reconstruct the entire attack chain. ProvNavigator required no instrumentation or reverse analysis and demonstrated general applicability. A prototype system was developed and was experimentally evaluated in 6 real attack scenarios, including 4 DARPA TC datasets. The experimental results show that ProvNavigator can effectively reconstruct attack stories, achieving 94.3% precision with only 6.01% runtime overhead.