English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

System auditing has emerged as a key approach for monitoring system callevents and investigating sophisticated attacks. Based on the collected auditlogs, research has proposed to search for attack patterns or track the causaldependencies of system events to reveal the attack sequence. However, existingapproaches either cannot reveal long-range attack sequences or suffer from thedependency explosion problem due to a lack of focus on attack-relevant parts,and thus are insufficient for investigating complex attacks.  To bridge the gap, we propose Zebra, a system that synergistically integratesattack pattern search and causal dependency tracking for efficient attackinvestigation. With Zebra, security analysts can alternate between search andtracking to reveal the entire attack sequence in a progressive, user-guidedmanner, while mitigating the dependency explosion problem by prioritizing theattack-relevant parts. To enable this, Zebra provides (1) an expressive andconcise domain-specific language, Tstl, for performing various types of searchand tracking analyses, and (2) an optimized language execution engine forefficient execution over a big amount of auditing data. Evaluations on a broadset of attack cases demonstrate the effectiveness of Zebra in facilitating atimely attack investigation.

Zebra: Deeply Integrating System-Level Provenance Search and Tracking for Efficient Attack Investigation