标题： 脱水器：通过分层编码和序列生成增强来源图存储 显示英文标题

标题： DEHYDRATOR: Enhancing Provenance Graph Storage via Hierarchical Encoding and Sequence Generation

摘要： 随着网络威胁的范围和影响不断扩大，分析人员利用审计日志来搜索威胁和调查攻击。 从内核日志构建的起源图越来越多地被视为理想的数据源，因为它们具有强大的语义表达能力和攻击历史相关性。 然而，由于内核事件的高频率和攻击的持续性，使用传统数据库存储起源图面临着高存储开销的挑战。 为了解决这个问题，我们提出了Dehydrator，一个高效的起源图存储系统。 对于审计框架生成的日志，Dehydrator使用字段映射编码来过滤字段级冗余，分层编码来过滤结构级冗余，并最终学习一个深度神经网络以支持批量查询。 我们在七个数据集上进行了评估，总计超过十亿条日志条目。 实验结果表明，Dehydrator将存储空间减少了84.55%。 Dehydrator比PostgreSQL高效7.36倍，比Neo4j高效7.16倍，比Leonard（与Dehydrator最相关的工作，发表于Usenix Security'23）高效16.17倍。 显示英文摘要

摘要： As the scope and impact of cyber threats have expanded, analysts utilize audit logs to hunt threats and investigate attacks. The provenance graphs constructed from kernel logs are increasingly considered as an ideal data source due to their powerful semantic expression and attack historic correlation ability. However, storing provenance graphs with traditional databases faces the challenge of high storage overhead, given the high frequency of kernel events and the persistence of attacks. To address this, we propose Dehydrator, an efficient provenance graph storage system. For the logs generated by auditing frameworks, Dehydrator uses field mapping encoding to filter field-level redundancy, hierarchical encoding to filter structure-level redundancy, and finally learns a deep neural network to support batch querying. We have conducted evaluations on seven datasets totaling over one billion log entries. Experimental results show that Dehydrator reduces the storage space by 84.55%. Dehydrator is 7.36 times more efficient than PostgreSQL, 7.16 times than Neo4j, and 16.17 times than Leonard (the work most closely related to Dehydrator, published at Usenix Security'23).