Back to Search Start Over

Are we there yet? An Industrial Viewpoint on Provenance-based Endpoint Detection and Response Tools

Are we there yet? An Industrial Viewpoint on Provenance-based Endpoint Detection and Response Tools

Authors :
Dong, Feng
Li, Shaofei
Jiang, Peng
Li, Ding
Wang, Haoyu
Huang, Liangyi
Xiao, Xusheng
Chen, Jiedong
Luo, Xiapu
Guo, Yao
Chen, Xiangqun
Publication Year :
2023

Abstract

Provenance-Based Endpoint Detection and Response (P-EDR) systems are deemed crucial for future APT defenses. Despite the fact that numerous new techniques to improve P-EDR systems have been proposed in academia, it is still unclear whether the industry will adopt P-EDR systems and what improvements the industry desires for P-EDR systems. To this end, we conduct the first set of systematic studies on the effectiveness and the limitations of P-EDR systems. Our study consists of four components: a one-to-one interview, an online questionnaire study, a survey of the relevant literature, and a systematic measurement study. Our research indicates that all industry experts consider P-EDR systems to be more effective than conventional Endpoint Detection and Response (EDR) systems. However, industry experts are concerned about the operating cost of P-EDR systems. In addition, our research reveals three significant gaps between academia and industry: (1) overlooking client-side overhead; (2) imbalanced alarm triage cost and interpretation cost; and (3) excessive server-side memory consumption. This paper's findings provide objective data on the effectiveness of P-EDR systems and how much improvements are needed to adopt P-EDR systems in industry.<br />Comment: The final version of this paper is going to appear in the ACM SIGSAC Conference on Computer and Communications Security (CCS'23), November 26-30, 2023, Copenhagen, Denmark

Details

Database :
arXiv
Publication Type :
Report
Accession number :
edsarx.2307.08349
Document Type :
Working Paper