Provenance-based Forensic and Incident Analysis

This research aims to develop AI based techniques for detecting and interpreting cyberattacks using provenance graphs. Recent work has shown the effectiveness of graph-based machine learning models at detecting attacks in provenance data. However, provenance graphs are extremely complex and thus detected attacks remain difficult to interpret by humans. Therefore, this project will investigate and develop explainable and interpretable machine learning methods for helping humans understand, for example, where an attack originated from, the steps involved in the attack, and the impact of the attack.