Poirot

Milajerdi, Sadegh M.; Eshete, Birhanu; Gjomemo, Rigel; Venkatakrishnan, V.

doi:10.1145/3319535.3363217

Cited by 130 publications

(17 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Due to the substructure in the provenance graph can completely describe malicious behavior, it is a very popular method to use graph matching-based detection method to detect APT attacks. For example, Poirot (Milajerdi et al, 2019a) threat detection is modeled as an imprecise graph pattern matching problem.…”

Section: Related Workmentioning

confidence: 99%

“…The APT detection research based on the provenance graph can be mainly divided into three directions: graph matchingbased detection (De Nardo et al, 2008) (Milajerdi et al, 2019a) (Han et al, 2020) (Goyal & Ferrara, 2018) (Wang et al, 2014) (Yan et al, 2006) (Liu et al, 2019) (Wang et al, 2020), anomaly score-based detection (Xie et al, 2020) (Xie et al, 2021) (Liu et al, 2018) (Hassan et al, 2019), and tag propagation-based detection (Jiang et al, 2006) (Hossain et al, 2017) (Milajerdi et al, 2019b) (Hossain et al, 2020). Most of this anomaly score-based and tag propagation-based attack detection methods are difficult to model long-term behavioral patterns.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats

Han¹,

Pasquier²,

Bates³

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

154

111

View full text Add to dashboard Cite

Advanced Persistent Threats (APTs) are difficult to detect due to their "low-and-slow" attack patterns and frequent use of zero-day exploits. We present UNICORN, an anomalybased APT detector that effectively leverages data provenance analysis. From modeling to detection, UNICORN tailors its design specifically for the unique characteristics of APTs. Through extensive yet time-efficient graph analysis, UNICORN explores provenance graphs that provide rich contextual and historical information to identify stealthy anomalous activities without predefined attack signatures. Using a graph sketching technique, it summarizes long-running system execution with space efficiency to combat slow-acting attacks that take place over a long time span. UNICORN further improves its detection capability using a novel modeling approach to understand long-term behavior as the system evolves. Our evaluation shows that UNICORN outperforms an existing state-of-the-art APT detection system and detects reallife APT scenarios with high accuracy.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats

Han¹,

Pasquier²,

Bates³

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

154

111

View full text Add to dashboard Cite

show abstract

“…Currently, several pieces of research are developed to build and analyze provenance graphs. These approaches span from system monitoring tools [55], [80], data storage [26], [47], [62], [89], [101], and attack detection and investigation [45], [74], [46], [37], [73], [13]. Following the existing work [25], [92], [74], [46], [45], [13], [105], we focus on the system events that are critical to attack steps, which we list in Table I.…”

Section: A Provenance Analysismentioning

confidence: 99%

NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation

Li,

Dong,

Xiao

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

“…The third form, graph-matching attack detection has grown in popularity during the last few years. Milajerdi et al proposed POIROT [19], and attacks are discovered as subgraphs in the provenance graph that are similar to the attack graph. Although the graph matching-based approach detects attacks more precisely, it necessitates the creation of attack graphs based on prior knowledge and cannot detect unknown attacks.…”

Section: Related Workmentioning

confidence: 99%

High Mycoplasma pneumoniae Loads and Persistent Long-term Mycoplasma pneumoniae DNA in Lower Airway Associated with Severity of Pediatric Mycoplasma pneumoniae Pneumonia

Liu

Zhao

et al. 2019

Preprint

View full text Add to dashboard Cite

Background: An increased number of refractory mycoplasma pneumoniae (MP) pneumonia (MPP) cases have been reported. However the duration of MP infection in lower airway and the course of anti-MP treatment remains unclear. Methods: We retrospectively reviewed the medical records of 94 MPP children. Patients were classified into two groups. The long-term group (Group LT) was defined as bronchoalveolar lavage fluid (BALF) remained MP-positive by PCR after 30 days of the disease course. The non-long-term group (Group NLT) was defined as BALF became MP-negative by PCR within 30 days of disease and patients who only needed one bronchoscopy lavage therapy. MP loads, clinical outcomes were analyzed along with other clinical measurements. Results: The average levels of inflammatory markers such as C reactive protein and lactate dehydrogenase in Group LT were significantly higher than those in Group NLT. Airway and lung damage in Group LT were more severe than Group NLT. 28 patients developed necrotizing pneumonia and 8 patients developed pulmonary embolism in Group LT. Mean maximum MP loads in BALF were 10 7.46±0.93 and 10 4.86±0.93 in Groups LT and NLT, respectively. There was persistent MP DNA in Group LT, even lasted for 120 days. One severe MPP patient in Group LT had MP-associated bloodstream infection. After 3 months of follow-up, chest imaging revealed incomplete absorption of pulmonary consolidation in 33 patients of Group LT [including 13 airway obliterans (AO) patients] and in 7 patients of Group NLT (including 2 AO patients). Conclusion: MP loads of BALF were associated with the subsequent duration of MP DNA in lower airway. High MP loads and persistent long-term MP DNA in lower airway were associated with severity of pediatric MPP.

show abstract

Poirot

Cited by 130 publications

References 34 publications

Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats

Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats

NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation

High Mycoplasma pneumoniae Loads and Persistent Long-term Mycoplasma pneumoniae DNA in Lower Airway Associated with Severity of Pediatric Mycoplasma pneumoniae Pneumonia

Contact Info

Product

Resources

About