Review of threat discovery and forensic analysis based on system provenance graph - Tao LENG; Lijun CAI; Aimin YU; Ziyuan ZHU; Jian’gang MA; Chaofei LI; Ruicheng NIU; Dan MENG (Tongxin xuebao)
By investigating works of literature related to provenance graph research, a research framework for network threat discovery and forensic analysis based on system-level provenance graph was proposed.A detailed overview of data collection, data management, data query, and visualization methods based on provenance graphs was provided.The rule-based, anomaly-based, and learning-based threat detection classification methods were proposed.Threats based on threat intelligence or based on strategy, technology, and process-driven threats hunting methods were summarized.Forensic analysis methods based on causality, sequence learning, language query and semantic reconstruction in special fields were summarized.Finally, the future research trends were pointed out.