Integrity Checking and Abnormality Detection of Provenance Records

Data provenance is a kind of meta-data recording inputs, entities and processes. It provides historical records and origin information of the data. Because of the rich information provided, provenance is increasingly being used as a foundation for security analysis and forensic auditing. For example, system-level provenance can help us trace activities at thelevel of libraries or system calls, which offers great potentialfor detecting subtle malicious activities that can otherwise goundetected. However, most of these security related applica-tions of provenance data require completeness and correctnessof the provenance collection process. This cannot be guar-anteed in some cases because some provenance recordingmodules collect information from some unreliable sources.We present work in progress on provenance graph integritychecking and abnormal component detection using ProvMark,the provenance expressiveness benchmarking tool. We alsodiscuss possible applications of the ProvMark tool in aid ofthe quality checking of provenance data.