{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,4]],"date-time":"2025-12-04T01:48:53Z","timestamp":1764812933178,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":50,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,6,23]],"date-time":"2020-06-23T00:00:00Z","timestamp":1592870400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100014718","name":"National Science Foundation","doi-asserted-by":"publisher","award":["ACI-1440800, ACI-1450277, ACI-1547467"],"award-info":[{"award-number":["ACI-1440800, ACI-1450277, ACI-1547467"]}],"id":[{"id":"10.13039\/100014718","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002790","name":"Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100002790","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,6,23]]},"DOI":"10.1145\/3391800.3398175","type":"proceedings-article","created":{"date-parts":[[2020,6,16]],"date-time":"2020-06-16T23:03:55Z","timestamp":1592348635000},"page":"27-32","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":4,"title":["Xanthus: Push-button Orchestration of Host Provenance Data Collection"],"prefix":"10.1145","author":[{"given":"Xueyuan","family":"Han","sequence":"first","affiliation":[{"name":"Harvard University, Cambridge, MA, USA"}]},{"given":"James","family":"Mickens","sequence":"additional","affiliation":[{"name":"Harvard University, Cambridge, MA, USA"}]},{"given":"Ashish","family":"Gehani","sequence":"additional","affiliation":[{"name":"SRI International, Menlo Park, CA, USA"}]},{"given":"Margo","family":"Seltzer","sequence":"additional","affiliation":[{"name":"University of British Columbia, Vancouver, BC, Canada"}]},{"given":"Thomas","family":"Pasquier","sequence":"additional","affiliation":[{"name":"University of Bristol, Bristol, United Kingdom"}]}],"member":"320","published-online":{"date-parts":[[2020,6,23]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Transparent computing engagement 3 data release accessed today. https:\/\/github.com\/darpa-i2o\/Transparent-Computing.  Transparent computing engagement 3 data release accessed today. https:\/\/github.com\/darpa-i2o\/Transparent-Computing."},{"key":"e_1_3_2_1_2_1","unstructured":"University of New Mexico system call dataset accessed today. https:\/\/www.cs.unm.edu\/~immsec\/systemcalls.html.  University of New Mexico system call dataset accessed today. https:\/\/www.cs.unm.edu\/~immsec\/systemcalls.html."},{"key":"e_1_3_2_1_3_1","unstructured":"VagrantCloud accessed today. https:\/\/app.vagrantup.com\/boxes\/search.  VagrantCloud accessed today. https:\/\/app.vagrantup.com\/boxes\/search."},{"key":"e_1_3_2_1_4_1","volume-title":"Workshop on the Theory and Practice of Provenance. USENIX","author":"Balakrishnan Nikilesh","year":"2013","unstructured":"Nikilesh Balakrishnan , Thomas Bytheway , Ripduman Sohan , and Andy Hopper . Opus : A lightweight system for observational provenance in user space . In Workshop on the Theory and Practice of Provenance. USENIX , 2013 . Nikilesh Balakrishnan, Thomas Bytheway, Ripduman Sohan, and Andy Hopper. Opus: A lightweight system for observational provenance in user space. In Workshop on the Theory and Practice of Provenance. USENIX, 2013."},{"key":"e_1_3_2_1_5_1","first-page":"319","volume-title":"Security Symposium","author":"Bates Adam","year":"2015","unstructured":"Adam Bates , Dave Jing Tian , Kevin~ RB Butler , and Thomas Moyer . Trustworthy whole-system provenance for the linux kernel . In Security Symposium , pages 319 -- 334 . USENIX, 2015 . Adam Bates, Dave Jing Tian, Kevin~RB Butler, and Thomas Moyer. Trustworthy whole-system provenance for the linux kernel. In Security Symposium, pages 319--334. USENIX, 2015."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/762476.762477"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/WCNC.2013.6555301"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2013.13"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3322790.3330593"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/ITCE.2019.8646601"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-35170-9_6"},{"key":"e_1_3_2_1_12_1","volume-title":"Mac OS X","author":"Gregg Brendan","year":"2011","unstructured":"Brendan Gregg and Jim Mauro . DTrace: Dynamic tracing in Oracle Solaris , Mac OS X , and FreeBSD. Prentice Hall Professional , 2011 . Brendan Gregg and Jim Mauro. DTrace: Dynamic tracing in Oracle Solaris, Mac OS X, and FreeBSD. Prentice Hall Professional, 2011."},{"key":"e_1_3_2_1_13_1","volume-title":"Workshop on the Theory and Practice of Provenance. USENIX","author":"Guo Philip J","year":"2012","unstructured":"Philip J Guo and Margo Seltzer . Burrito : Wrapping your lab notebook in computational infrastructure . In Workshop on the Theory and Practice of Provenance. USENIX , 2012 . Philip J Guo and Margo Seltzer. Burrito: Wrapping your lab notebook in computational infrastructure. In Workshop on the Theory and Practice of Provenance. USENIX, 2012."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.3390\/fi8030029"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2017.03.018"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24046"},{"key":"e_1_3_2_1_17_1","volume-title":"Workshop on Hot Topics in Cloud Computing (HotCloud). USENIX","author":"Han Xueyuan","year":"2017","unstructured":"Xueyuan Han , Thomas Pasquier , Tanvi Ranjan , Mark Goldstein , and Margo Seltzer . Frappuccino : Fault-detection through runtime analysis of provenance . In Workshop on Hot Topics in Cloud Computing (HotCloud). USENIX , 2017 . Xueyuan Han, Thomas Pasquier, Tanvi Ranjan, Mark Goldstein, and Margo Seltzer. Frappuccino: Fault-detection through runtime analysis of provenance. In Workshop on Hot Topics in Cloud Computing (HotCloud). USENIX, 2017."},{"key":"e_1_3_2_1_18_1","volume-title":"Workshop on the Theory and Practice of Provenance. USENIX","author":"Han Xueyuan","year":"2018","unstructured":"Xueyuan Han , Thomas Pasquier , and Margo Seltzer . Provenance-based intrusion detection: opportunities and challenges . In Workshop on the Theory and Practice of Provenance. USENIX , 2018 . Xueyuan Han, Thomas Pasquier, and Margo Seltzer. Provenance-based intrusion detection: opportunities and challenges. In Workshop on the Theory and Practice of Provenance. USENIX, 2018."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23141"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/WCNC.2019.8885534"},{"key":"e_1_3_2_1_22_1","first-page":"38","volume-title":"International Conference on Distributed Computing Systems (ICDCS)","author":"Jiang Xuxian","year":"2006","unstructured":"Xuxian Jiang , A Aron Walters , Dongyan Xu , Eugene H Spafford , Florian Buchholz , and Yi-Min Wang . Provenance-aware tracing of worm break-in and contaminations: A process coloring approach . In International Conference on Distributed Computing Systems (ICDCS) , pages 38 -- 38 . IEEE, 2006 . Xuxian Jiang, AAron Walters, Dongyan Xu, Eugene H Spafford, Florian Buchholz, and Yi-Min Wang. Provenance-aware tracing of worm break-in and contaminations: A process coloring approach. In International Conference on Distributed Computing Systems (ICDCS), pages 38--38. IEEE, 2006."},{"key":"e_1_3_2_1_23_1","first-page":"1","volume-title":"International Workshop on Recent Advances in Intrusion Detection","author":"Jiang Xuxian","year":"2005","unstructured":"Xuxian Jiang , Dongyan Xu , Helen~ J Wang , and Eugene H Spafford . Virtual playgrounds for worm behavior investigation . In International Workshop on Recent Advances in Intrusion Detection , pages 1 -- 21 . Springer , 2005 . Xuxian Jiang, Dongyan Xu, Helen~J Wang, and Eugene H Spafford. Virtual playgrounds for worm behavior investigation. In International Workshop on Recent Advances in Intrusion Detection, pages 1--21. Springer, 2005."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/IPDPSW.2017.157"},{"key":"e_1_3_2_1_25_1","volume-title":"No Starch Press","author":"Kennedy David","year":"2011","unstructured":"David Kennedy , Jim O'gorman , Devon Kearns , and Mati Aharoni . Metasploit : The penetration tester's guide . No Starch Press , 2011 . David Kennedy, Jim O'gorman, Devon Kearns, and Mati Aharoni. Metasploit: The penetration tester's guide. No Starch Press, 2011."},{"key":"e_1_3_2_1_26_1","volume-title":"An introduction to the dataverse network as an infrastructure for data sharing","author":"King Gary","year":"2007","unstructured":"Gary King . An introduction to the dataverse network as an infrastructure for data sharing , 2007 . Gary King. An introduction to the dataverse network as an infrastructure for data sharing, 2007."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2002.1007776"},{"key":"e_1_3_2_1_28_1","volume-title":"The 1999 darpa off-line intrusion detection evaluation. Computer Networks, 34(4):579--595","author":"Lippmann Richard","year":"2000","unstructured":"Richard Lippmann , Joshua W Haines , David~ J Fried , Jonathan Korba , and Kumar Das . The 1999 darpa off-line intrusion detection evaluation. Computer Networks, 34(4):579--595 , 2000 . Richard Lippmann, Joshua W Haines, David~J Fried, Jonathan Korba, and Kumar Das. The 1999 darpa off-line intrusion detection evaluation. Computer Networks, 34(4):579--595, 2000."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23254"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2008.69"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-45248-5_13"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939783"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/382912.382923"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"volume-title":"Metasploitable 2 exploitability guide. Retrieved June, 27:2013","year":"2012","key":"e_1_3_2_1_35_1","unstructured":"HD~Moore. Metasploitable 2 exploitability guide. Retrieved June, 27:2013 , 2012 . HD~Moore. Metasploitable 2 exploitability guide. Retrieved June, 27:2013, 2012."},{"key":"e_1_3_2_1_36_1","first-page":"43","volume-title":"Annual Technical Conference","author":"Muniswamy-Reddy Kiran-Kumar","year":"2006","unstructured":"Kiran-Kumar Muniswamy-Reddy , David~ A Holland , Uri Braun , and Margo I Seltzer . Provenance-aware storage systems . In Annual Technical Conference , pages 43 -- 56 . USENIX, 2006 . Kiran-Kumar Muniswamy-Reddy, David~A Holland, Uri Braun, and Margo I Seltzer. Provenance-aware storage systems. In Annual Technical Conference, pages 43--56. USENIX, 2006."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2013.6698896"},{"key":"e_1_3_2_1_38_1","volume-title":"Engineering, and Medicine et al. Reproducibility and replicability in science","author":"National Academies of Sciences","year":"2019","unstructured":"National Academies of Sciences , Engineering, and Medicine et al. Reproducibility and replicability in science . National Academies Press , 2019 . National Academies of Sciences, Engineering, and Medicine et al. Reproducibility and replicability in science. National Academies Press, 2019."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/CIS.2011.6169141"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/3127479.3129249"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243776"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2017.8170835"},{"key":"e_1_3_2_1_43_1","first-page":"259","volume-title":"Annual Computer Security Applications Conference","author":"Pohly J","year":"2012","unstructured":"Devin~ J Pohly , Stephen McLaughlin , Patrick McDaniel , and Kevin Butler . Hi-Fi : Collecting high-fidelity whole-system provenance . In Annual Computer Security Applications Conference , pages 259 -- 268 . ACM, 2012 . Devin~J Pohly, Stephen McLaughlin, Patrick McDaniel, and Kevin Butler. Hi-Fi: Collecting high-fidelity whole-system provenance. In Annual Computer Security Applications Conference, pages 259--268. ACM, 2012."},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/1341431.1341443"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.5220\/0006639801080116"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2011.12.012"},{"key":"e_1_3_2_1_47_1","volume-title":"Long-span program behavior modeling and attack detection. Transactions on Privacy and Security (TOPS), 20(4):12","author":"Shu Xiaokui","year":"2017","unstructured":"Xiaokui Shu , Danfeng~Daphne Yao , Naren Ramakrishnan , and Trent Jaeger . Long-span program behavior modeling and attack detection. Transactions on Privacy and Security (TOPS), 20(4):12 , 2017 . Xiaokui Shu, Danfeng~Daphne Yao, Naren Ramakrishnan, and Trent Jaeger. Long-span program behavior modeling and attack detection. Transactions on Privacy and Security (TOPS), 20(4):12, 2017."},{"key":"e_1_3_2_1_48_1","volume-title":"Workshop on the Theory and Practice of Provenance. USENIX","author":"Spillane P","year":"2009","unstructured":"Richard~ P Spillane , Russell Sears , Chaitanya Yalamanchili , Sachin Gaikwad , Manjunath Chinni , and Erez Zadok . Story book : An efficient extensible provenance framework . In Workshop on the Theory and Practice of Provenance. USENIX , 2009 . Richard~P Spillane, Russell Sears, Chaitanya Yalamanchili, Sachin Gaikwad, Manjunath Chinni, and Erez Zadok. Story book: An efficient extensible provenance framework. In Workshop on the Theory and Practice of Provenance. USENIX, 2009."},{"key":"e_1_3_2_1_49_1","volume-title":"Toward credible evaluation of anomaly-based intrusion-detection methods. Transactions on Systems, Man, and Cybernetics, 40(5):516--524","author":"Tavallaee Mahbod","year":"2010","unstructured":"Mahbod Tavallaee , Natalia Stakhanova , and Ali~Akbar Ghorbani . Toward credible evaluation of anomaly-based intrusion-detection methods. Transactions on Systems, Man, and Cybernetics, 40(5):516--524 , 2010 . Mahbod Tavallaee, Natalia Stakhanova, and Ali~Akbar Ghorbani. Toward credible evaluation of anomaly-based intrusion-detection methods. Transactions on Systems, Man, and Cybernetics, 40(5):516--524, 2010."},{"key":"e_1_3_2_1_50_1","volume-title":"Symposium on Network and Distributed System Security (NDSS)","author":"Hassan Wajih~Ul","year":"2020","unstructured":"Qi~Wang, Wajih~Ul Hassan , Ding Li , Kangkook Jee , Xiao Yu , Kexuan Zou , Junghwan Rhee , Zhengzhang Chen , Wei Cheng , C~Gunter, et~al. You are what you do: Hunting stealthy malware via data provenance analysis . In Symposium on Network and Distributed System Security (NDSS) , 2020 . Qi~Wang, Wajih~Ul Hassan, Ding Li, Kangkook Jee, Xiao Yu, Kexuan Zou, Junghwan Rhee, Zhengzhang Chen, Wei Cheng, C~Gunter, et~al. You are what you do: Hunting stealthy malware via data provenance analysis. In Symposium on Network and Distributed System Security (NDSS), 2020."}],"event":{"name":"HPDC '20: The 29th International Symposium on High-Performance Parallel and Distributed Computing","sponsor":["University of Arizona University of Arizona","SIGHPC ACM Special Interest Group on High Performance Computing, Special Interest Group on High Performance Computing","SIGARCH ACM Special Interest Group on Computer Architecture"],"location":"Stockholm Sweden","acronym":"HPDC '20"},"container-title":["Proceedings of the 3rd International Workshop on Practical Reproducible Evaluation of Computer Systems"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3391800.3398175","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3391800.3398175","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:41:41Z","timestamp":1750200101000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3391800.3398175"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,6,23]]},"references-count":50,"alternative-id":["10.1145\/3391800.3398175","10.1145\/3391800"],"URL":"https:\/\/doi.org\/10.1145\/3391800.3398175","relation":{},"subject":[],"published":{"date-parts":[[2020,6,23]]},"assertion":[{"value":"2020-06-23","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}