Skip to content

Commit 91ba9a1

Browse files
authored
Merge pull request #6 from ubc-provenance/dev
Release notes
2 parents 9f6180f + ed15a6e commit 91ba9a1

2 files changed

Lines changed: 24 additions & 29 deletions

File tree

README.md

Lines changed: 20 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,14 @@
1-
[![Support Dev Containers](https://img.shields.io/static/v1?label=Dev%20Containers&message=Open&color=blue)](https://code.visualstudio.com/docs/devcontainers/create-dev-container)
21
[![Documentation](https://img.shields.io/badge/docs-online-pink.svg)](https://ubc-provenance.github.io/PIDSMaker/)
32
[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.15603122.svg)](https://doi.org/10.5281/zenodo.15603122)
4-
5-
# Sometimes Simpler is Better: A Comprehensive Analysis of State-of-the-Art Provenance-Based Intrusion Detection Systems
6-
7-
# Citation
8-
9-
If you use this work, please cite the following paper:
10-
```
11-
@inproceedings{bilot2025simpler,
12-
title={{Sometimes Simpler is Better: A Comprehensive Analysis of State-of-the-Art Provenance-Based Intrusion Detection Systems}},
13-
author={Bilot, Tristan and Jiang, Baoxiang and Li, Zefeng and El Madhoun, Nour and Al Agha, Khaldoun and Zouaoui, Anis and Pasquier, Thomas},
14-
booktitle={Security Symposium (USENIX Sec'25)},
15-
year={2025},
16-
organization={USENIX}
17-
}
18-
```
3+
![GitHub License](https://img.shields.io/github/license/ubc-provenance/PIDSMaker)
194

205
# 🥷 PIDSMaker
216

227
The first framework designed to build and experiment with provenance-based intrusion detection systems (PIDSs) using deep learning architectures.
238
It provides a single codebase to run most recent state-of-the-arts systems and easily customize them to develop new variants.
249

2510
**Currently supported PIDSs**:
11+
- Velox (USENIX Sec'25): [Sometimes Simpler is Better: A Comprehensive Analysis of State-of-the-Art Provenance-Based Intrusion Detection Systems](https://tfjmp.org/publications/2025-usenixsec-2.pdf)
2612
- Orthrus (USENIX Sec'25): [ORTHRUS: Achieving High Quality of Attribution in Provenance-based Intrusion Detection Systems](https://www.usenix.org/system/files/conference/usenixsecurity25/sec25cycle1-prepub-103-jiang-baoxiang.pdf)
2713
- R-Caid (IEEE S\&P'24): [R-CAID: Embedding Root Cause Analysis within Provenance-based Intrusion Detection](https://gangw.web.illinois.edu/rcaid-sp24.pdf)
2814
- Flash (IEEE S\&P'24): [Flash: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning](https://dartlab.org/assets/pdf/flash.pdf)
@@ -40,7 +26,11 @@ git clone https://github.com/ubc-provenance/PIDSMaker.git
4026

4127
### ⏰ 10-min Docker Install with DARPA TC/OpTC Datasets
4228

43-
We have made the installation of DARPA TC/OpTC easy and fast, simply follow [these guidelines](docs/docs/ten-minute-install.md).
29+
We have made the installation of DARPA TC/OpTC easy and fast, simply follow [these guidelines](http://localhost:8000/PIDSMaker/ten-minute-install/).
30+
31+
## Documentation
32+
33+
A comprehensive [documentation](https://ubc-provenance.github.io/PIDSMaker/) is available, explaining all possible arguments and providing examples on how integrating new systems.
4434

4535
## Basic usage of the framework
4636

@@ -65,6 +55,19 @@ Once you have a shell in the pids container, experiments can be run in multiple
6555
```
6656
You can still watch the logs in your shell using `tail -f nohup.out`
6757

58+
## Citation
59+
60+
If you use this work, please cite the following paper:
61+
```
62+
@inproceedings{bilot2025simpler,
63+
title={{Sometimes Simpler is Better: A Comprehensive Analysis of State-of-the-Art Provenance-Based Intrusion Detection Systems}},
64+
author={Bilot, Tristan and Jiang, Baoxiang and Li, Zefeng and El Madhoun, Nour and Al Agha, Khaldoun and Zouaoui, Anis and Pasquier, Thomas},
65+
booktitle={Security Symposium (USENIX Sec'25)},
66+
year={2025},
67+
organization={USENIX}
68+
}
69+
```
70+
6871
## License
6972
7073
See [licence](LICENSE).

docs/docs/release_notes.md

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
99
1010
## [Unreleased]
1111
12-
## [1.0.0] - 2017-06-20
13-
### Added
14-
- TODO
15-
- TODO
16-
17-
### Changed
18-
- TODO
19-
- TODO
20-
21-
### Removed
22-
- TODO
23-
- TODO
12+
## [1.0.0] - 2025-06-05
13+
- Initial release
14+
- Systems: Velox, Orthrus, R-Caid, Flash, Kairos, Magic, NodLink, ThreaTrace
15+
- Datasets: CLEARSCOPE_E3, CADETS_E3, THEIA_E3, CLEARSCOPE_E5, THEIA_E5, optc_h201, optc_h501, optc_h051

0 commit comments

Comments
 (0)