SoK finds host intrusion detectors leave time assumptions unstated
Original title: SoK: Timestamps Are Not a Time Model: Rethinking Temporal Reasoning in Host-Based Intrusion Detection
A review of detector papers finds most provenance systems state no clock bound and trust stored evidence.
A systematization of knowledge argues host-based intrusion detectors order events and attack stages by timestamps while leaving clock, delivery, identity, and evidence-integrity assumptions implicit. The authors define five time-model components, an evidence checklist, and four guarantee levels, then apply them to a running campaign. Their search covers fifteen detection and investigation families and assesses temporal reasoning formalisms on nine attack patterns. They report current provenance-based detectors state no clock bound and that none of the audited papers says which conclusions survive deleted, delayed, or forged records.
Unconfirmed: The findings apply to the authors' selected and audited paper set, not every detector.
- Fifteen families of detection and investigation were identified in a documented search.
- Eleven temporal formalisms and a learned baseline were assessed on nine attack patterns.
- In 28 of 38 audited provenance-era papers, evidence manipulation is trusted or out of scope.
- Four audited papers describe input-ordering conditions, but none covers delivery-failure validity.
- Five open challenges follow from the identified gaps.
From the original article
1 min read at arxiv.orgHost-based intrusion detectors order events, window audit streams and sequence attack stages by their timestamps. Every conclusion they draw therefore rests on assumptions about clocks, delivery, entity identity and the integrity of the evidence, and most of these assumptions go unstated. This Systematization of Knowledge (SoK) makes them explicit.
By Rene Heinzl · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.