Can Data Provenance Put an End to the Data Breach?

Presented on September 13, 2019 at 12:00 p.m. in the Engineered Biosystems Building (EBB), room 1005.Adam Bates is an Assistant Professor in the Computer Science Department at the University of Illinois at Urbana-Champaign. Adam has conducted research on a range of security topics including operating system design, network communications, and peripheral devices. He is best known for his work in the area of data provenance, where he investigates the construction and application of secure provenance-aware systems.Runtime: 50:38 minutesIn a provenance-aware system, mechanisms gather and report metadata that describes the history of each data object being processed, allowing us to understand how objects came to exist in their present state. Excitingly, we can also use provenance to trace the actions of system intruders, enabling smarter and faster incident response. In this talk, I will describe our efforts to manage and analyze attack provenance in today’s massive distributed environments. First, I will explain how grammar induction techniques can be applied to provenance graphs in order to eliminate redundancy in distributed logs and correlate events across a network. Next, I will share our recent results on combatting the problem of intrusion detection “alert fatigue” through a provenance-based triage technique. I will conclude by discussing some of the opportunities and challenges that are guiding our continued work in this space. By addressing key security and performance issues, this work is paving the way for the further proliferation of secure provenance capabilities