Computer Science Department
Computer Science Department Technical Report Number: NU-CS-2021-01 June, 2021 Intrusion Response via Graph-based Low-level System Event Analysis Authors Xutong Chen Abstract This report presents the evolution of the endpoint security system and discusses novel challenges in the state-of-the-art endpoint security system, i.e., endpoint detection response (EDR) based on graph-based low-level system event analysis, when its deployment is required under different platform/environment/task setups. To elaborate and answer this problem, two research projects will be introduced, i.e., RATScope for Windows/Operating System/Detection and CLARION Linux/Container/Forensics. Keywords System security, Malicious behavior analysis, Forensics, Provenance tracking, Microservice and container NORTHWESTERN UNIVERSITY Intrusion Response via Graph-based Low-level System Event Analysis A DISSERTATION SUBMITTED TO THE GRADUATE SCHOOL IN PARTIAL FULFILLMENT OF THE REQUIREMENTS for the degree DOCTOR OF PHILOSOPHY Field of Computer Science By Xutong Chen EVANSTON, ILLINOIS June 2021 2 © Copyright by Xutong Chen 2021 All Rights Reserved 3 ABSTRACT Intrusion Response via Graph-based Low-level System Event Analysis Xutong Chen From cyber theft of personal financial information to Advanced Persistent Threat (APT) attacks, nowadays endpoint devices suffer from various intrusions which cause inestimable property and privacy loss. To protect the security on endpoints, endpoint detection and response (EDR) systems have been developed to serve as the powerful solu- tion against those intrusions. Among numerous EDR systems, those based on graph-based low-level system event analysis generally benefit from their higher detection accuracy and they are also less likely to be compromised or evaded.
[Show full text]