Tactical Provenance Analysis for Endpoint Detection and Response Systems

TLDR

EDR tools expose sophisticated intrusions by matching events to known behaviors, yet they generate many false alarms, overwhelm analysts with low‑level logs, and often lose long‑term attack traces due to log retention limits. The study aims to enhance commercial EDR tools by introducing Tactical Provenance Graphs and a threat‑scoring method that uses causal and temporal relationships among alerts to reduce false alarms. The authors build RapSheet, which constructs Tactical Provenance Graphs that capture causal links between alerts, applies a temporal threat‑scoring algorithm, and stores only a minimal skeleton graph to link past and future alerts, evaluated on Symantec EDR in an enterprise setting. The approach yields compact visualizations that speed investigations, correctly ranks malicious TPGs above false alarms, and cuts long‑term log‑retention burden by up to 87%.

Abstract

Endpoint Detection and Response (EDR) tools provide visibility into sophisticated intrusions by matching system events against known adversarial behaviors. However, current solutions suffer from three challenges: 1) EDR tools generate a high volume of false alarms, creating backlogs of investigation tasks for analysts; 2) determining the veracity of these threat alerts requires tedious manual labor due to the overwhelming amount of low-level system logs, creating a "needle-in-a-haystack" problem; and 3) due to the tremendous resource burden of log retention, in practice the system logs describing long-lived attack campaigns are often deleted before an investigation is ever initiated.This paper describes an effort to bring the benefits of data provenance to commercial EDR tools. We introduce the notion of Tactical Provenance Graphs (TPGs) that, rather than encoding low-level system event dependencies, reason about causal dependencies between EDR-generated threat alerts. TPGs provide compact visualization of multi-stage attacks to analysts, accelerating investigation. To address EDR's false alarm problem, we introduce a threat scoring methodology that assesses risk based on the temporal ordering between individual threat alerts present in the TPG. In contrast to the retention of unwieldy system logs, we maintain a minimally-sufficient skeleton graph that can provide linkability between existing and future threat alerts. We evaluate our system, RapSheet, using the Symantec EDR tool in an enterprise environment. Results show that our approach can rank truly malicious TPGs higher than false alarm TPGs. Moreover, our skeleton graph reduces the long-term burden of log retention by up to 87%.