During my UROP project I researched and worked on a solution to gather whole system provenance. Whole system provenance is a chain of events for every process and data, every action that a user or the system is involved in is logged. There are already systems that can gather such information, but they are either limited in their functionality or are used for intrusion detection. We are trying to build a system that could observe a user and in case of suspicious activities could retrace the users work. During the UROP project a proof of concept is being developed to show how the observation could be created for more applications on the system. The final step would be to create a graph from which we can observe how the system has changed.
Fabio Oesch
