Modern enterprise networks comprise diverse and heterogeneous systems that support a wide range of services, making it challenging for administrators to track and analyze sophisticated attacks such as advanced persistent threats (APTs), which often exploit multiple vectors. To address this challenge, we introduce the concept of network-level security provenance, which enables the systematic establishment of causal relationships across hosts at the network level, facilitating the accurate identification of the root causes of security incidents. Building on this concept, we present SecTracer as a framework for a network-wide provenance analysis. SecTracer offers three main contributions: (i) comprehensive and efficient forensic data collection in enterprise networks via software-defined networking (SDN), (ii) reconstruction of attack histories through provenance graphs to provide a clear and interpretable view of intrusions, and (iii) proactive attack prediction using probabilistic models. We evaluated the effectiveness and efficiency of SecTracer through a real-world APT simulation, demonstrating its capability to enhance threat mitigation while introducing less than 1% network throughput overhead and negligible latency impact.

翻译：现代企业网络由支持广泛服务的多样化异构系统构成，这使得管理员难以追踪和分析利用多向量的复杂攻击（如高级持续性威胁）。为应对这一挑战，我们提出了网络级安全溯源的概念，该概念能够在网络层面系统性地建立跨主机的因果关系，从而促进安全事件根本原因的准确识别。基于这一概念，我们提出了SecTracer作为全网溯源分析的框架。SecTracer提供了三个主要贡献：（i）通过软件定义网络在企业网络中实现全面高效的取证数据收集；（ii）通过溯源图重建攻击历史，提供清晰可解释的入侵视图；（iii）利用概率模型进行主动攻击预测。我们通过真实世界的高级持续性威胁模拟评估了SecTracer的有效性和效率，结果表明其在引入低于1%的网络吞吐量开销和可忽略的延迟影响的同时，能够有效增强威胁缓解能力。