Enabling Efficient Attack Investigation via Human-in-the-Loop Security Analysis
Summary: Provexa enables human-in-the-loop, scalable provenance-based attack investigation via ProvQL, a DSL with primitives for pattern search and dependency tracking plus user constraints to focus analyses. An optimized engine lets analysts iteratively and efficiently sift massive system-call provenance to reveal long multi-step APTs. (summarized by gpt-5-mini on Feb 09 2026)
Incoming Non-self Citations Over Time
No non-self incoming citations found for this paper in this database.
Authors
- 1. Saimon Amanuel Tsegai (Virginia Tech)
- 2. Xinyu Yang (Virginia Tech)
- 3. Haoyuan Liu (University of California Berkeley)
- 4. Peng Gao (Virginia Tech)
BibTeX Citation
@article{tsegai_vldb25,
title = {{Enabling Efficient Attack Investigation via Human-in-the-Loop Security Analysis}},
author = {Tsegai, Saimon Amanuel and Yang, Xinyu and Liu, Haoyuan and Gao, Peng},
journal = {PVLDB},
series = {{VLDB} '25},
volume = {18},
number = {11},
pages = {3771--3783},
doi = {10.14778/3749646.3749653},
url = {https://doi.org/10.14778/3749646.3749653},
year = {2025}
}Incoming Citations (Sorted by Pagerank)
Showing 0 of 0 citing papers.
| Rank | Citing Paper | Year | Venue | Pagerank |
|---|
Previous
Page 1 / 1
Next
Outgoing Citations (Sorted by Pagerank)
Showing 1 of 1 cited papers.
Citations counted here include only citations to other VLDB/SIGMOD/CIDR/PODS papers in this database.
| Rank | Cited Paper | Year | Venue | Pagerank |
|---|---|---|---|---|
| 979 | Declarative Networking: Language, Execution and Optimization | 2006 | SIGMOD | 0.00012820867 |
Previous
Page 1 / 1
Next
Semantically Similar Papers
| # | Overall Rank | Paper | Year | Venue |
|---|---|---|---|---|
| 1 | 4,618 | Provenance for Natural Language Queries | 2017 | VLDB |
| 2 | 4,542 | Context-Sensitive Program Analysis as Database Queries | 2005 | PODS |
| 3 | 9,799 | NLProv: Natural Language Provenance | 2016 | VLDB |
| 4 | 2,817 | Data Provenance at Internet Scale: Architecture, Experiences, and the Road Ahead | 2017 | CIDR |
| 5 | 6,407 | DProvDB: Differentially Private Query Processing with Multi-Analyst Provenance | 2023 | SIGMOD |
| 6 | 8,983 | OneProvenance: Efficient Extraction of Dynamic Coarse-Grained Provenance From Database Query Event Logs | 2023 | VLDB |
| 7 | 11,712 | A System for Automated Open-Source Threat Intelligence Gathering and Management | 2021 | SIGMOD |
| 8 | 7,951 | Provenance-Enabled Explainable AI | 2024 | SIGMOD |
| 9 | 10,236 | ANTEATER: A Filter-then-Scrutinize Architecture for End-to-End Attack Investigation | 2026 | SIGMOD |
| 10 | 13,559 | A Query System for Efficiently Investigating Complex Attack Behaviors for Enterprise Security | 2019 | VLDB |