You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+20-17Lines changed: 20 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,28 +1,14 @@
1
-
[](https://code.visualstudio.com/docs/devcontainers/create-dev-container)
The first framework designed to build and experiment with provenance-based intrusion detection systems (PIDSs) using deep learning architectures.
23
8
It provides a single codebase to run most recent state-of-the-arts systems and easily customize them to develop new variants.
24
9
25
10
**Currently supported PIDSs**:
11
+
- Velox (USENIX Sec'25): [Sometimes Simpler is Better: A Comprehensive Analysis of State-of-the-Art Provenance-Based Intrusion Detection Systems](https://tfjmp.org/publications/2025-usenixsec-2.pdf)
26
12
- Orthrus (USENIX Sec'25): [ORTHRUS: Achieving High Quality of Attribution in Provenance-based Intrusion Detection Systems](https://www.usenix.org/system/files/conference/usenixsecurity25/sec25cycle1-prepub-103-jiang-baoxiang.pdf)
27
13
- R-Caid (IEEE S\&P'24): [R-CAID: Embedding Root Cause Analysis within Provenance-based Intrusion Detection](https://gangw.web.illinois.edu/rcaid-sp24.pdf)
28
14
- Flash (IEEE S\&P'24): [Flash: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning](https://dartlab.org/assets/pdf/flash.pdf)
### ⏰ 10-min Docker Install with DARPA TC/OpTC Datasets
42
28
43
-
We have made the installation of DARPA TC/OpTC easy and fast, simply follow [these guidelines](docs/docs/ten-minute-install.md).
29
+
We have made the installation of DARPA TC/OpTC easy and fast, simply follow [these guidelines](http://localhost:8000/PIDSMaker/ten-minute-install/).
30
+
31
+
## Documentation
32
+
33
+
A comprehensive [documentation](https://ubc-provenance.github.io/PIDSMaker/) is available, explaining all possible arguments and providing examples on how integrating new systems.
44
34
45
35
## Basic usage of the framework
46
36
@@ -65,6 +55,19 @@ Once you have a shell in the pids container, experiments can be run in multiple
65
55
```
66
56
You can still watch the logs in your shell using `tail -f nohup.out`
67
57
58
+
## Citation
59
+
60
+
If you use this work, please cite the following paper:
61
+
```
62
+
@inproceedings{bilot2025simpler,
63
+
title={{Sometimes Simpler is Better: A Comprehensive Analysis of State-of-the-Art Provenance-Based Intrusion Detection Systems}},
64
+
author={Bilot, Tristan and Jiang, Baoxiang and Li, Zefeng and El Madhoun, Nour and Al Agha, Khaldoun and Zouaoui, Anis and Pasquier, Thomas},
0 commit comments