<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-01859773</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-26T13:47:24+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Runtime Analysis of Whole-System Provenance</title>
            <author role="aut">
              <persName>
                <forename type="first">Thomas</forename>
                <surname>Pasquier</surname>
              </persName>
              <email type="md5">10a34eb34de51eeb1a0cbfaab703c41d</email>
              <email type="domain">cl.cam.ac.uk</email>
              <idno type="idhal" notation="string">thomas-pasquier</idno>
              <idno type="idhal" notation="numeric">16283</idno>
              <idno type="halauthorid" notation="string">23876-16283</idno>
              <idno type="IDREF">https://www.idref.fr/129900885</idno>
              <idno type="ORCID">https://orcid.org/0000-0001-6876-1306</idno>
              <idno type="GOOGLE SCHOLAR">https://scholar.google.co.uk/citations?user=TplQGj4AAAAJ</idno>
              <affiliation ref="#struct-220393"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Xueyuan</forename>
                <surname>Han</surname>
              </persName>
              <idno type="halauthorid">1412821-0</idno>
              <affiliation ref="#struct-461178"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Thomas</forename>
                <surname>Moyer</surname>
              </persName>
              <idno type="halauthorid">1412822-0</idno>
              <orgName ref="#struct-362799"/>
              <affiliation ref="#struct-362799"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Adam</forename>
                <surname>Bates</surname>
              </persName>
              <idno type="halauthorid">309885-0</idno>
              <affiliation ref="#struct-303576"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Olivier</forename>
                <surname>Hermant</surname>
              </persName>
              <email type="md5">4a0323f972b105d88e98833f173bd83b</email>
              <email type="domain">pps.jussieu.fr</email>
              <idno type="idhal" notation="string">olivier-hermant</idno>
              <idno type="idhal" notation="numeric">3275</idno>
              <idno type="halauthorid" notation="string">17324-3275</idno>
              <idno type="ORCID">https://orcid.org/0000-0001-6233-1903</idno>
              <idno type="IDREF">https://www.idref.fr/103569715</idno>
              <affiliation ref="#struct-96176"/>
              <affiliation ref="#struct-301492"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">David</forename>
                <surname>Eyers</surname>
              </persName>
              <email type="md5">ee7d275fe3b35a8dd5dc49dd22dcdd3f</email>
              <email type="domain">cs.otago.ac.nz</email>
              <idno type="idhal" notation="numeric">1003290</idno>
              <idno type="halauthorid" notation="string">1143098-1003290</idno>
              <affiliation ref="#struct-416928"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Jean</forename>
                <surname>Bacon</surname>
              </persName>
              <email type="md5">7eddd86fc551b73da9a3bb15c2c892d2</email>
              <email type="domain">cl.cam.ac.uk</email>
              <idno type="idhal" notation="numeric">1018153</idno>
              <idno type="halauthorid" notation="string">853243-1018153</idno>
              <affiliation ref="#struct-237843"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Margo</forename>
                <surname>Seltzer</surname>
              </persName>
              <idno type="halauthorid">1271900-0</idno>
              <affiliation ref="#struct-366034"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Claire</forename>
                <surname>Medrala</surname>
              </persName>
              <email type="md5">c9c7dadc49f086531ff5a5601f16f27a</email>
              <email type="domain">cri.ensmp.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2018-08-22 15:36:41</date>
              <date type="whenModified">2026-02-12 14:52:04</date>
              <date type="whenReleased">2018-08-22 15:36:41</date>
              <date type="whenProduced">2018-10-15</date>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="142715">
                <persName>
                  <forename>Claire</forename>
                  <surname>Medrala</surname>
                </persName>
                <email type="md5">c9c7dadc49f086531ff5a5601f16f27a</email>
                <email type="domain">cri.ensmp.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-01859773</idno>
            <idno type="halUri">https://minesparis-psl.hal.science/hal-01859773</idno>
            <idno type="halBibtex">pasquier:hal-01859773</idno>
            <idno type="halRefHtml">&lt;i&gt;The 25th ACM Conference on Computer and Communications Security&lt;/i&gt;, Oct 2018, Toronto, Canada. pp.1601-1616</idno>
            <idno type="halRef">The 25th ACM Conference on Computer and Communications Security, Oct 2018, Toronto, Canada. pp.1601-1616</idno>
            <availability status="restricted"/>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="ENSMP" corresp="PARISTECH">MINES ParisTech</idno>
            <idno type="stamp" n="ENSMP_CRI" corresp="ENSMP">Recherche en informatique (CRI) </idno>
            <idno type="stamp" n="PARISTECH">ParisTech</idno>
            <idno type="stamp" n="PSL">Université Paris sciences et lettres</idno>
            <idno type="stamp" n="ENSMP_DEP_MS">Département Mathématiques et systèmes</idno>
            <idno type="stamp" n="ENSMP_DR" corresp="ENSMP">ENSMP_DR</idno>
            <idno type="stamp" n="ENSMP-PSL" corresp="PSL">MINES ParisTech - École nationale supérieure des mines de Paris - PSL</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Runtime Analysis of Whole-System Provenance</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Thomas</forename>
                    <surname>Pasquier</surname>
                  </persName>
                  <email type="md5">10a34eb34de51eeb1a0cbfaab703c41d</email>
                  <email type="domain">cl.cam.ac.uk</email>
                  <idno type="idhal" notation="string">thomas-pasquier</idno>
                  <idno type="idhal" notation="numeric">16283</idno>
                  <idno type="halauthorid" notation="string">23876-16283</idno>
                  <idno type="IDREF">https://www.idref.fr/129900885</idno>
                  <idno type="ORCID">https://orcid.org/0000-0001-6876-1306</idno>
                  <idno type="GOOGLE SCHOLAR">https://scholar.google.co.uk/citations?user=TplQGj4AAAAJ</idno>
                  <affiliation ref="#struct-220393"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Xueyuan</forename>
                    <surname>Han</surname>
                  </persName>
                  <idno type="halauthorid">1412821-0</idno>
                  <affiliation ref="#struct-461178"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Thomas</forename>
                    <surname>Moyer</surname>
                  </persName>
                  <idno type="halauthorid">1412822-0</idno>
                  <orgName ref="#struct-362799"/>
                  <affiliation ref="#struct-362799"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Adam</forename>
                    <surname>Bates</surname>
                  </persName>
                  <idno type="halauthorid">309885-0</idno>
                  <affiliation ref="#struct-303576"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Olivier</forename>
                    <surname>Hermant</surname>
                  </persName>
                  <email type="md5">4a0323f972b105d88e98833f173bd83b</email>
                  <email type="domain">pps.jussieu.fr</email>
                  <idno type="idhal" notation="string">olivier-hermant</idno>
                  <idno type="idhal" notation="numeric">3275</idno>
                  <idno type="halauthorid" notation="string">17324-3275</idno>
                  <idno type="ORCID">https://orcid.org/0000-0001-6233-1903</idno>
                  <idno type="IDREF">https://www.idref.fr/103569715</idno>
                  <affiliation ref="#struct-96176"/>
                  <affiliation ref="#struct-301492"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">David</forename>
                    <surname>Eyers</surname>
                  </persName>
                  <email type="md5">ee7d275fe3b35a8dd5dc49dd22dcdd3f</email>
                  <email type="domain">cs.otago.ac.nz</email>
                  <idno type="idhal" notation="numeric">1003290</idno>
                  <idno type="halauthorid" notation="string">1143098-1003290</idno>
                  <affiliation ref="#struct-416928"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Jean</forename>
                    <surname>Bacon</surname>
                  </persName>
                  <email type="md5">7eddd86fc551b73da9a3bb15c2c892d2</email>
                  <email type="domain">cl.cam.ac.uk</email>
                  <idno type="idhal" notation="numeric">1018153</idno>
                  <idno type="halauthorid" notation="string">853243-1018153</idno>
                  <affiliation ref="#struct-237843"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Margo</forename>
                    <surname>Seltzer</surname>
                  </persName>
                  <idno type="halauthorid">1271900-0</idno>
                  <affiliation ref="#struct-366034"/>
                </author>
              </analytic>
              <monogr>
                <meeting>
                  <title>The 25th ACM Conference on Computer and Communications Security</title>
                  <date type="start">2018-10-15</date>
                  <date type="end">2018-10-19</date>
                  <settlement>Toronto</settlement>
                  <country key="CA">Canada</country>
                </meeting>
                <imprint>
                  <biblScope unit="pp">1601-1616</biblScope>
                </imprint>
              </monogr>
              <ref type="publisher">https://www.sigsac.org/ccs/CCS2018/</ref>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halDomain" n="info.info-fl">Computer Science [cs]/Formal Languages and Automata Theory [cs.FL]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Identifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of information within a computing system, connecting suspicious events to their root causes.Although existing provenance-based auditing techniques provide value in forensic analysis, they assume that such analysis takes place only retrospectively. Such post-hoc analysis is insufficient for realtime security applications; moreover, even for forensic tasks, prior provenance collection systems exhibited poor performance and scalability, jeopardizing the timeliness of query responses.We present CamQuery, which provides inline, realtime provenance analysis, making it suitable for implementing security applications. CamQuery is a Linux Security Module that offers support for both userspace and in-kernel execution of analysis applications. We demonstrate the applicability of CamQuery to a variety of runtime security applications including data loss prevention, intrusion detection, and regulatory compliance. In evaluation, we demonstrate thatCamQuery reduces the latency of realtime query mechanisms, while imposing minimal overheads on system execution. CamQuery thus enables the further deployment of provenance-based technologies to address central challenges in computer security. Preprint: the final version of this paper will appear in the proceedings of the 25th ACM Conference on Computer and Communications Security in October 2018 (https://www.sigsac.org/ccs/CCS2018/).</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-220393" status="VALID">
          <idno type="ROR">https://ror.org/0524sp257</idno>
          <orgName>University of Bristol [Bristol]</orgName>
          <desc>
            <address>
              <addrLine>Senate House, Tyndall Avenue, Bristol BS8 1TH</addrLine>
              <country key="GB"/>
            </address>
            <ref type="url">http://www.bris.ac.uk/</ref>
          </desc>
        </org>
        <org type="regrouplaboratory" xml:id="struct-461178" status="VALID">
          <orgName>Harvard John A. Paulson School of Engineering and Applied Sciences</orgName>
          <orgName type="acronym">SEAS</orgName>
          <desc>
            <address>
              <addrLine>150 Western Ave, Allston, MA 02134, 29 Oxford Street, Cambridge, MA 02138</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">https://www.seas.harvard.edu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-38302" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-362799" status="VALID">
          <orgName>University of North Carolina [Charlotte]</orgName>
          <orgName type="acronym">UNC</orgName>
          <desc>
            <address>
              <addrLine>9201 University City Blvd, Charlotte, NC 28223-0001</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">http://www.uncc.edu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-566986" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-303576" status="VALID">
          <idno type="ROR">https://ror.org/047426m28</idno>
          <orgName>University of Illinois at Urbana-Champaign [Urbana]</orgName>
          <orgName type="acronym">UIUC</orgName>
          <desc>
            <address>
              <addrLine>205 N. Mathews Ave., Urbana-Champaign, IL 61801</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">http://illinois.edu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-325015" type="direct"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-96176" status="VALID">
          <idno type="IdRef">154122696</idno>
          <idno type="ROR">https://ror.org/020cdve92</idno>
          <orgName>Centre de Recherche en Informatique</orgName>
          <orgName type="acronym">CRI</orgName>
          <desc>
            <address>
              <addrLine>35 rue Saint-Honoré 77305 Fontainebleau cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://cri.mines-paristech.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-301492" type="direct"/>
            <relation active="#struct-564132" type="indirect"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-301492" status="VALID">
          <idno type="IdRef">026375249</idno>
          <idno type="ROR">https://ror.org/04y8cs423</idno>
          <orgName>Mines Paris - PSL (École nationale supérieure des mines de Paris)</orgName>
          <date type="start">1783-01-01</date>
          <desc>
            <address>
              <addrLine>60, boulevard Saint-Michel 75006 Paris</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.minesparis.psl.eu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-564132" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-416928" status="VALID">
          <idno type="IdRef">034371362</idno>
          <orgName>University of Otago [Dunedin, Nouvelle-Zélande]</orgName>
          <date type="start">1869</date>
          <desc>
            <address>
              <addrLine>362 Leith St, North Dunedin, Dunedin 9016, New-Zeland</addrLine>
              <country key="NZ"/>
            </address>
            <ref type="url">https://www.otago.ac.nz/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-237843" status="VALID">
          <idno type="IdRef">027706338</idno>
          <idno type="ROR">https://ror.org/013meh722</idno>
          <orgName>University of Cambridge [Cambridge, UK]</orgName>
          <orgName type="acronym">CAM</orgName>
          <desc>
            <address>
              <addrLine>The Old Schools, Trinity Lane, Cambridge CB2 1TN</addrLine>
              <country key="GB"/>
            </address>
            <ref type="url">http://www.cam.ac.uk/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-366034" status="VALID">
          <idno type="IdRef">028326792</idno>
          <idno type="ISNI">0000000122889830</idno>
          <idno type="ROR">https://ror.org/03rmrcq20</idno>
          <idno type="Wikidata">Q391028</idno>
          <orgName>University of British Columbia [Canada]</orgName>
          <orgName type="acronym">UBC</orgName>
          <date type="start">1908-01-01</date>
          <desc>
            <address>
              <addrLine>Vancouver Campus, 2329 West Mall, Vancouver, BC, V6T 1Z4 / Okanagan Campus, 3333 University Way, Kelowna, BC, V1V 1V7</addrLine>
              <country key="CA"/>
            </address>
            <ref type="url">https://www.ubc.ca</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-38302" status="VALID">
          <idno type="IdRef">026453169</idno>
          <idno type="ROR">https://ror.org/03vek6s52</idno>
          <orgName>Harvard University</orgName>
          <desc>
            <address>
              <addrLine>Massachusetts Hall, Cambridge, MA 02138</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">http://www.harvard.edu/</ref>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-566986" status="VALID">
          <orgName>University of North Carolina System</orgName>
          <orgName type="acronym">UNC</orgName>
          <desc>
            <address>
              <country key="US"/>
            </address>
            <ref type="url">https://www.northcarolina.edu</ref>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-325015" status="VALID">
          <idno type="ROR">https://ror.org/05e94g991</idno>
          <orgName>University of Illinois System</orgName>
          <desc>
            <address>
              <addrLine>108 Henry Administration Bldg.Urbana, IL 61801</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">https://www.uillinois.edu/</ref>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-564132" status="VALID">
          <idno type="IdRef">241597595</idno>
          <idno type="ISNI">0000 0004 1784 3645</idno>
          <idno type="ROR">https://ror.org/013cjyk83</idno>
          <orgName>Université Paris Sciences et Lettres</orgName>
          <orgName type="acronym">PSL</orgName>
          <desc>
            <address>
              <addrLine>60 rue Mazarine 75006 Paris</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.psl.eu/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>