1,721,108 research outputs found
Towards Query interoperability: PASSing PLUS
Get PDFWe describe our experiences importing PASS [16] provenance into PLUS [7]. Although both systems import and export provenance that conforms to the Open Provenance Model (OPM) [14], the two systems vary greatly with respect to the granularity of provenance captured, how much semantic knowledge the system contributes, and the completeness of provenance capture. We encountered several problems reconciling provenance between the two systems and use that experience to specify a Common Provenance Framework, that provides a higher degree of interoperability between provenance systems. In each case, the problems stem from the fact that OPM interoperability is a weaker requirement than query interoperability. Our goal in presenting this work is to generate discussion about differing degrees of interoperability and the requirements thereof.Engineering and Applied SciencesAccepted Manuscrip
Recommended from our members
Detecting System Anomalies Using Kernel-level Data Provenance
No full textModern cyber-attacks are increasingly difficult to detect. For example, advanced persistent threats (APTs) slowly infiltrate a network of systems and can remain undetected for months. Alternatively, attackers can corrupt digital supply chains to distribute malware from trusted software vendors, infesting millions of systems for weeks before the malware (and the corrupted supply channels) is discovered.
We develop anomaly-based techniques to detect attacks without a priori attack knowledge. A key insight of our work is that attackers frequently request system-level services, such as system calls, to accomplish their mission; however, they manipulate kernel objects in ways that deviate from normal system behavior. Therefore, by analyzing interactions between these objects, we can identify anomalies that signify attack footprints. To this end, we leverage kernel-level data provenance, which represents the history of system execution as a directed acyclic graph (DAG) called a provenance graph, as the information source to analyze these interactions.
To detect APTs, we present Unicorn. Unicorn continuously monitors host behavior to detect anomalous system activities that hide amongst normal operations for long periods of time. To do so efficiently as the provenance graph grows large over time, Unicorn summarizes essential properties of the graph into a time series of compact graph sketches. Graph sketches that deviate significantly from known benign sketches indicate the presence of an attack.
To detect malicious software installation, we introduce SIGL. SIGL learns kernel interactions of benign software installations to pinpoint unusual graph patterns from specific installation processes that are likely launched by malware. To do so, SIGL adapts graph-based machine learning (ML) techniques to system-level provenance graphs and uses an unsupervised learning architecture to explain its detection.
In summary, this dissertation demonstrates that modern attacks can exhibit distinguishable system-level behaviors; that these behaviors result in anomalies that are captured in kernel-level data provenance; and that provenance graphs can be used to detect system anomalies to perform effective intrusion and malware detection
Sarwat : a rule-based intrusion detection system for self-driving laboratories
No full textA self-driving laboratory is a cyber-physical system that uses software-controlled laboratory equipment, such as robot arms and smart devices, to permit autonomous experimentation. Intelligent systems in these laboratories can independently conduct experiments, analyze results, and identify a subsequent experiment to run. However, self-driving laboratories are vulnerable to security attacks due to their dependence on networked communication. Further, a naive researcher could make human errors while prototyping new experiments. Both an attacker or a naive researcher could potentially create dangerous situations that pose risks to the safety and security of self-driving laboratories. For instance, they could make a robot arm crash into expensive equipment or launch dangerous experiments. We present Sarwat, a rule-based intrusion detection system (IDS) for self-driving laboratories, designed to prevent unsafe behavior. Sarwat uses a set of rules for defining the actions that are allowed in a self-driving laboratory. If an action inside the laboratory violates any of the rules, Sarwat raises an alarm. Sarwat achieves an overall detection rate of 75%, making it effective for most of the unsafe scenarios we identified. We conducted a pilot study to evaluate the user-friendliness of Sarwat and found that the initial setup of Sarwat in a self-driving laboratory requires our assistance. However, once configured, it is easy to maintain, making it valuable for training new users and prototyping new experiments. Additionally, Sarwat introduces minimal latency overhead of 1.5% to the ongoing experiment workflows of a self-driving laboratory. Therefore, Sarwat allows researchers in a self-driving laboratory to perform experiments safely and securely.Science, Faculty ofComputer Science, Department ofGraduat
Security through isolation for cloud and mobile
No full textPeople store increasing amounts of personal data digitally, from emails to credit cards. Two prevalent places this data is stored are on cloud platforms hosted by third parties and on mobile devices, which are easily lost or stolen and which run any of millions of untrusted third-party applications.
We explore security through isolation as a means to protect the sensitive data residing on cloud and mobile platforms. We carefully consider the attributes of each platform and the specifics of the attacks we are trying to protect against to select isolation mechanisms that provide the necessary security benefit without incurring an undue performance penalty.
Today's cloud platforms provide isolation through virtualization boundaries, which are typically managed by a monolithic control VM. We decompose such monolithic entities to reduce the attack surface. We break apart the control VM of Xen, a mature virtualization platform, into least-privilege components. We leverage this disaggregation to restart these components frequently, reducing the time window for attacks.
Today's mobile platforms provide isolation through passwords and process boundaries. However, these protection mechanisms do little once an attacker can access the physical memory directly. We encrypt sensitive data while it is in memory to prevent direct, physical access to it. We leverage cache locking to provide a safe location embedded within the system chip itself to decrypt application data as it is required.
Sharing data between applications is crucial for mobile platforms and is achieved using inter-process communication (IPC). An attacker that gains control of the OS also gains access to all this shared data. We encrypt IPC using a security monitor that operates outside the OS. Leveraging previous work on strong application boundaries, we provide end-to-end encrypted IPC, preventing a compromised OS from being able to access this sensitive data.
We demonstrate three systems. First, we disaggregate Xen's monolithic control VM, improving security and reducing performance by 2% or less for most benchmarks. Second, we protect sensitive data on mobile devices from physical memory attacks while preserving performance within 5% for normal Android application usage. Third, we protect all IPC on Android devices incurring no noticeable performance overhead.Science, Faculty ofComputer Science, Department ofGraduat
Reproducibility as a service
No full textRecent studies demonstrated that the reproducibility of previously published computational experiments is inadequate. Many of these published computational experiments are not reproducible, because they never recorded or preserved their computational environment. This environment consists of artifacts such as packages installed in the language, libraries installed on the host system, file names, and directory hierarchy. Researchers have created reproducibility tools to help mitigate this problem, but they do nothing for the experiments that already exist in online repositories. This situation is not improving, as researchers continue to publish results every year without using reproducibility tools, likely due to benign neglect as it is common to believe publishing the code and data is sufficient for reproducibility. To clarify the gap between what existing reproducibility tools are capable of and this issue with published experiments, we define a framework to distinguish between actions taken by a researcher to facilitate reproducibility in the presence of a computational environment and actions taken by a researcher to enable reproduction of an experiment when that environment has been lost. The difference between these approaches in reproducibility lies in the availability of a computational environment. Researchers that provide access to the original computational environment perform proactive reproducibility, while those who do not enable only retroactive reproducibility. We present Reproducibility as a Service (RaaS), which is, to our knowledge, the first reproducibility tool explicitly designed to facilitate retroactive reproducibility. We demonstrate how RaaS can fix many of the common errors found in R scripts on Harvard's Dataverse and preserve the recreated computational environment.Science, Faculty ofComputer Science, Department ofGraduat
Anomaly detection in multiplex networks : from human brain activity to financial networks
No full textThe problem of identifying anomalies in dynamic networks is a fundamental task with a wide range of applications from understanding brain diseases/disorders to fraud detection in financial networks. However, it raises critical challenges due to the complex nature of anomalies, lack of ground truth knowledge, and complex and dynamic interactions in the network. Most existing approaches usually study simple networks with a single type of connection. However many complex systems exhibit natural relationships with different types of connections, yielding multiplex networks. We first propose ANOMULY, a graph neural network-based unsupervised edge anomaly detection framework for multiplex dynamic networks. ANOMULY learns node encodings in different relation types, separately, and then uses an attention mechanism that incorporates information across different types of relations. To improve generalizability and scalability, we further propose ADMIRE, an inductive and unsupervised anomaly detection method that extracts the causality of the existence of connections by temporal network motifs. To extract the temporal network motifs, ADMIRE uses two different casual multiplex walks, inter-view and intra-view that automatically extract and learn temporal multiplex network motifs. Despite the outstanding performance of ADMIRE, using it in sensitive decision-making tasks requires explanations for the model's predictions. Accordingly, we introduce an interpretable, weighted optimal sparse decision tree model, ADMIRE++, that mimics ADMIRE, to provide explanations for ADMIRE's predictions. With extensive experiments, we show the efficiency and effectiveness of our approaches in detecting anomalous connections in various domains, including social and financial networks. We further focus on understanding abnormal human brain activity of people living with Parkinson’s Disease, Attention Deficit Hyperactivity Disorder, and Autism Spectrum Disorder to show how these methods can assist in understanding the biomarkers for these diseases.Science, Faculty ofComputer Science, Department ofGraduat
Vertex-and-edge ordering for faster parallel graph processing
No full textGraph structured data, which models complex relationships, describes data in myriad domains, such as social network analysis, protein structure analysis, and supply chain management. As the size of graph data grows, researchers develop modern systems to handle massive datasets with trillions of entries. To accelerate processing, systems optimize the data layout of vertices and edges in memory or on disk, but, to date, researchers have treated the performance improvements due to vertex and edge orderings separately. This work investigates the interaction between vertex and edge
orderings. We explore whether combining these orderings improves performance. An extensive
performance study of different orderings finds that a specific combination, the SlashBurn vertex
order and the Hilbert edge order, consistently provides the fastest runtimes for scale-free graphs.
These results motivate our development of a parallelized SlashBurn and the Rhubarb edge ordering
and blocking technique. Using 14 cores, Parallel SlashBurn is up to 11.96× faster than the sequential
implementation. Rhubarb enables the scalable implementation of parallel edge-centric algorithms
using the Hilbert curve and offers end-to-end performance speedup for the Collaborative Filtering
application of up to more than 2.5× over modern parallel Graph Processing Systems.Science, Faculty ofComputer Science, Department ofGraduat
2GP : two-phase graph partitioner
No full textGraph partitioning is a crucial problem for processing and analyzing large graphs. The two main classes of graph partitioners are in-memory partitioners and streaming partitioners. In-memory partitioners require that the entire graph be read into memory before being partitioned into some number of partitions. Conversely, a streaming partitioner reads the graph one edge at a time and immediately places the source and destination vertices in a partition, unless they have already been placed. While in-memory partitioners produce higher-quality partitions, they require a large amount of memory and are slow, which makes them less practical for larger graphs. Streaming partitioners can partition large graphs quickly. However, since they lack more information about the overall graph, their placement decisions are not as good as in-memory partitioners, leading to lower-quality partitions.
We designed and evaluated a two-phase partitioning algorithm (2GP) that combines the best of both worlds. 2GP has two phases: first, it read a portion of a graph into memory and partitions it using an in-memory partitioner. Then, it partitions the remaining graph using a streaming partitioner. 2GP achieves better partition quality than a state-of-the-art streaming partitioner with significantly better performance.Science, Faculty ofComputer Science, Department ofGraduat
Temporal hypergraph representation learning : from predicting future interactions in networks to anomaly detection in the human brain
No full textTemporal graphs have emerged as a fundamental tool for modeling dynamic systems across diverse domains. However, existing research predominantly centers on pairwise interactions, while many real-world complex systems involve interactions among multiple entities. Hypergraphs allow edges to connect any number of vertices, enabling the representation of higher-order structures in data. Consequently, extracting and learning patterns of temporal, higher-order interactions is important in domains such as social network analysis, neuroscience, and finance.
This thesis makes two contributions. First, we introduce CAT-WALK, which is a method for representation learning on temporal hypergraphs. Then, we illustrate the value of temporal hypergraph modeling and CAT-WALK in neuroscience applications. We introduce HYPERBRAIN, a framework for detecting abnormal co-activations in brain networks.
CAT-WALK is an inductive method that uses a novel higher-order random walk to learn hyperedge representations. It uses a novel permutation-invariant pooling strategy in conjunction with a set-based anonymization process to hide the identity of hyperedges. Additionally, we present a straightforward, yet effective, neural network model for encoding hyperedges. Through extensive experiments, we demonstrate the efficacy of CAT-WALK in 1) predicting future hyperedges and 2) classifying nodes.
The second part of this thesis demonstrates how we can encode brain networks as hypergraphs and use CAT-WALK for analyzing them. We introduce HYPERBRAIN, an anomaly detection framework for temporal hypergraph brain networks. HYPERBRAIN first represents fMRI time series data as temporal hypergraphs and subsequently uses CAT-WALK for hypergraph representation learning. Customizing both the temporal higher-order walk and the training approach for the analysis of brain networks, HYPERBRAIN can effectively learn the structural and temporal properties of these brain networks and identify anomalous hyperedges in the brain of individuals with disorders. We evaluate the performance of HYPERBRAIN in both synthetic and real-world settings for Attention Deficit Hyperactivity Disorder (ADHD), and Autism Spectrum Disorder.Science, Faculty ofComputer Science, Department ofGraduat
- …
