Attack Provenance Tracing in Cyberspace: Solutions, Challenges and Future Directions

With the increasing damage of APT attacks, the modern world has moved from individual hackers for fun to nation-wide cybercriminals for strategic advantage or profit. These APT attacks are often prolonged and have multiple stages, and they usually utilize zero-day or one-day exploits to be penetrating and stealthy. As a result, there is an urgent need to detect and investigate APT attacks. Among all kinds of security techniques, provenance tracing is regarded as a promising and important approach for attack investigation, as it discloses the root cause, the path, and the results of attacks. However, the existing techniques either suffer from the limitation of only focusing on the log type, or have non-trivial space and runtime overhead, which hinder their wide applications in practice. In this article, we provide a comprehensive survey of provenance tracing technologies in the most recent literature. Following the overview of each scheme, we present the key technical features of them and then compare the state-of-the-art solutions in terms of both security and performance. Finally, we propose and discuss several potential future research directions.