Attack Analysis Results for Adversarial Engagement 1 of the DARPA Transparent Computing Program

We built a tagand policy-based analysis system for attack detection and forensic analysis. Our system tracks information flows from sources to sensitive sinks in real time, and raises alarms when the policies are violated. In addition, it keeps a provenance context with every entity in the system. Specifically, provenance context contains a list of the events and relationships that contribute to the existence of an entity. Using such provenance context, we are able to provide an explanation for the raised alarms under the form of dot graphs. During Engagement 1, we successfully detected the attacks on several TA1 traces and produced graphs with details about those attacks.