Session 7A: Forensics CCS’18, October 15-19, 2018, Toronto, ON, Canada NodeMerge: Template Based Efficient Data Reduction For Big-Data Causality Analysis Yutao Tang2, Ding Li1, Zhichun Li1, Mu Zhang3, Kangkook Jee1, Xusheng Xiao4, Zhenyu Wu1, Junghwan Rhee1, Fengyuan Xu5, Qun Li2 1NEC Laboratories America Inc 2The College of William and Mary 3Cornell University 4Case Western Reserve University 5National Key Lab for Novel Software Technology, Nanjing University 1{dingli,zhichun,kjee,adamwu,rhee}@nec-labs.com 2{yytang,liqun}@cs.wm.edu
[email protected] [email protected] [email protected] ABSTRACT KEYWORDS Today’s enterprises are exposed to sophisticated attacks, such as Security, Data Reduction Advanced Persistent Threats (APT) attacks, which usually consist of ACM Reference Format: stealthy multiple steps. To counter these attacks, enterprises often Yutao Tang, Ding Li, Zhichun Li, Mu Zhang, Kangkook Jee, Xusheng Xiao, rely on causality analysis on the system activity data collected from Zhenyu Wu, Junghwan Rhee, Fengyuan Xu, Qun Li. 2018. Node-Merge: a ubiquitous system monitoring to discover the initial penetration Template Based Efficient Data Reduction For Big-Data Causality point, and from there identify previously unknown attack steps. Analysis. In 2018 ACM SIGSAC Conference on Computer and Communications However, one major challenge for causality analysis is that the Security (CCS ’18), October 15–19, 2018, Toronto, ON, Canada. ACM, New ubiquitous system monitoring generates a colossal amount of data York, NY, USA, 14 pages. https://doi.org/10.1145/3243734.3243763 and hosting such a huge amount of data is prohibitively expensive. Thus, there is a strong demand for techniques that reduce the storage 1 INTRODUCTION of data for causality analysis and yet preserve the quality of the Modern enterprises are facing the challenge of Advanced Persistent causality analysis.