Mining and integrating program-level context information into low-level system provenance graphs

1. A computer-implemented method for computer intrusion detection, comprising:

establishing a mapping from low-level system calls to user functions in computer programs, the user functions running in a user space of an operating system;

identifying, using a search algorithm inputting the mapping and a system-call trace captured at runtime, any of the user functions that trigger the low-level system calls in the system-call trace; and

performing, by a processor device, intrusion detection responsive to a provenance graph with program contexts, the provenance graph having nodes formed from the user functions that trigger the low-level system calls in the system-call trace, wherein edges in the provenance graph have edge labels describing high-level system operations for low-level system call to high-level system operation correlation-based intrusion detection.

2. The computer-implemented method of claim 1 , wherein establishing the mapping comprises performing binary analysis and machine learning on the computer programs to (1) extract control flow graphs (CFGs) from the user functions and identify CFG nodes that trigger system calls or make function calls to other user functions; (2) perform graph walks through the CFGs to collect system-call sequences that the function calls may trigger; (3) train, using the system-call sequences, a system-call-sequence embedding model that can convert a system-call sequence, from among the system-call sequences, into a vector-space representation.

3. The computer-implemented method of claim 2 , wherein train, using the system-call sequences, a system-call-sequence embedding model comprises:

generating a system-call-sequence corpus for each of the user functions that represents the possible system-call-sequence patterns for each of the user functions; and

training the system-call-sequence embedding model using the corpus generated for each of the user functions.

4. The computer-implemented method of claim 2 , wherein the embedding model converts varying-length system-call sequences to a fixed length vector as the vector-space representation.

5. The computer-implemented method of claim 1 , wherein the search algorithm comprises (1) a heuristic method to segment the system-call trace in order to reduce a search space for user function identification; (2) a search method leveraging the system-call-sequence embedding model, the system-call sequences collected from the CFGs, and a set of heuristics to enumerate candidates of possible ones of the user functions within a segment of the system-call trace; and (3) a quality measurement function to compare different ones of the candidates and select a set of most likely candidates as a search output.

6. The computer-implemented method of claim 1 , wherein the any of the user functions that trigger the low-level system calls in the system-call trace are identified in an embedding space.

7. The computer-implemented method of claim 1 , further comprising enriching the system-call trace with user function information.

8. The computer-implemented method of claim 1 , further comprising merging two of the edges of the provenance graph based on user function information.

9. The computer-implemented method of claim 1 , further comprising performing a CFG reduction on at least one of the CFGs by removing non-function-call nodes therefrom to form a function-call graph.

10. The computer-implemented method of claim 1 , further comprising performing two-layer graph walking to extract system-call sequences, a first layer of the two-layer graph walking based on a boundary of higher-level user functions that do not directly trigger system call and lower-level user functions that trigger system calls.

11. A computer program product for computer intrusion detection, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:

establishing, by a processor device of the computer, a mapping from low-level system calls to user functions in computer programs, the user functions running in a user space of an operating system;

identifying, by the processor device using a search algorithm inputting the mapping and a system-call trace captured at runtime, any of the user functions that trigger the low-level system calls in the system-call trace; and

performing, by the processor device, intrusion detection responsive to a provenance graph with program contexts, the provenance graph having nodes formed from the user functions that trigger the low-level system calls in the system-call trace, wherein edges in the provenance graph have edge labels describing high-level system operations for low-level system call to high-level system operation correlation-based intrusion detection.

12. The computer program product of claim 11 , wherein establishing the mapping comprises performing binary analysis and machine learning on the computer programs to (1) extract control flow graphs (CFGs) from the user functions and identify CFG nodes that trigger system calls or make function calls to other user functions; (2) perform graph walks through the CFGs to collect system-call sequences that the function calls may trigger; (3) train, using the system-call sequences, a system-call-sequence embedding model that can convert a system-call sequence, from among the system-call sequences, into a vector-space representation.

13. The computer program product of claim 12 , wherein train, using the system-call sequences, a system-call-sequence embedding model comprises:

generating a system-call-sequence corpus for each of the user functions that represents the possible system-call-sequence patterns for each of the user functions; and

training the system-call-sequence embedding model using the corpus generated for each of the user functions.

14. The computer program product of claim 12 , wherein the embedding model converts varying-length system-call sequences to a fixed length vector as the vector-space representation.

15. The computer program product of claim 11 , wherein the search algorithm comprises (1) a heuristic method to segment the system-call trace in order to reduce a search space for user function identification; (2) a search method leveraging the system-call-sequence embedding model, the system-call sequences collected from the CFGs, and a set of heuristics to enumerate candidates of possible ones of the user functions within a segment of the system-call trace; and (3) a quality measurement function to compare different ones of the candidates and select a set of most likely candidates as a search output.

16. The computer program product of claim 11 , wherein the any of the user functions that trigger the low-level system calls in the system-call trace are identified in an embedding space.

17. The computer program product of claim 11 , wherein the method further comprises enriching the system-call trace with user function information.

18. The computer program product of claim 11 , wherein the method further comprises merging two of the edges of the provenance graph based on user function information.

19. The computer program product of claim 11 , wherein the method further comprises performing a CFG reduction on at least one of the CFGs by removing non-function-call nodes therefrom to form a function-call graph.

20. A computer processing system for computer intrusion detection, comprising:

a memory device for storing program code; and

a hardware processor operatively coupled to the memory device for running the program code to

establish a mapping from low-level system calls to user functions in computer programs, the user functions running in a user space of an operating system;

identify, using a search algorithm inputting the mapping and a system-call trace captured at runtime, any of the user functions that trigger the low-level system calls in the system-call trace; and

perform intrusion detection responsive to a provenance graph with program contexts, the provenance graph having nodes formed from the user functions that trigger the low-level system calls in the system-call trace, wherein edges in the provenance graph have edge labels describing high-level system operations for low-level system call to high-level system operation correlation-based intrusion detection.