This is the first edition of the a workshop for the CYPRESS (CausalitY, PRovenancE and Security ApplicationS) informal research group, which discusses various aspects such as causality graphs, provenance-based IDSes and vulnerability reproduction The event was made possible by the PTCC team from Inria. Indeed Inria booked a room for the workshop, and was very helpful for the logistics.
We would also like to thank all the participants: beyond the local teams from Institut Polytechnique de Paris and the neighbors from Orange, several attendants were from French research teams (LAAS-CNRS, Airbus) and from Univeristy of Luxembourg. Thank you for taking the time to come and discuss!
This page contains the program of the workshop, as well as the corresponding resources when they were publicly shareable.
Date: Wednesday October 14th
Location: Campus Cyber (GATE 5 meeting room at Inria PTCC)
Provenance supports security monitoring and forensics by capturing causal relationships between system objects and representing them as provenance graphs. On Linux, eBPF has become the preferred capture means for provenance, yet three fundamental design choices remain unsettled: i) Where to capture in the kernel execution flow; ii) What kernel hooks to instru- ment; and iii) How to model captured objects as graph nodes. We show that these choices impact the portability, robustness, performance, and utility of provenance capture systems. We also find that existing approaches either produce unsound graphs or cannot uniquely identify kernel objects without a patched kernel. Thus, we propose RECAP, an eBPF-based capture system that addresses all three choices: i) Where: the Linux Security Module (LSM) interface provides the most suitable capture location; ii) What: 43 LSM hooks specifically selected for security-oriented use cases, whereas existing capture systems capture too much or too little; and iii) How: objects are versioned only on modification and uniquely identified without a patched kernel. Compared to state-of-the-art LSM-based systems, RECAP produces sound and 11–20× more concise graphs, yielding on average 3–13× better detection performance with Provenance-based Intrusion Detection Systems (PIDS) and 4× better with signature-based forensics, while significantly reducing data loss and imposing similar or lower overhead. To support these claims, we provide a dataset of provenance graphs captured by RECAP and the capture systems we used for comparison, spanning benign and malicious scenarios
Related reference in which we studied the capture layer of existing provenance graph capture systems
Provenance-based intrusion detection systems (PIDS) frequently report strong performance, but the conclusions drawn from these results can be highly sensitive to benchmarking choices and evaluation protocols. We investigate this dependency by re-evaluating representative PIDS on public datasets that meet our audit, labeling, and calibration requirements. Focusing primarily on the audited DARPA TC E3 datasets, we apply a unified protocol with temporally separated test periods and validation-only checkpoint and threshold calibration, and ask which architectural claims are empirically supported. We find that alerting success and investigation utility can diverge sharply, as several systems surface attacks without providing enough process-level context to support forensic investigation. On three of the four primary datasets, a simple allowlist built from training executable names and paths matches or exceeds the selected learned baselines on key operating-point metrics, suggesting that much of their measured performance reflects lexical novelty rather than richer provenance modeling. To explain why only some datasets expose architectural differences, we measure semantic signal quality through feature completeness and field entropy. This analysis helps explain why several audited E3 datasets can expose alerting behavior without reliably separating model architectures, while Theia pairs the strongest semantic signal quality with the clearest improvements in ranking and node-level recovery by our reference model. These results show that architectural claims in PIDS should be interpreted together with the benchmark properties and evaluation protocol that produced them.
Reproducing software vulnerabilities is fundamental to security researchers, open-source maintainers, and educators. Yet, vulnerabilities are often hard to reproduce, and even when they can be reproduced once, recreating a software environment where the vulnerability can be exploited becomes harder and harder over time. We present NICE, the NIx CvE reproduction framework, which uses declarative recipes to build and automatically validate vulnerable environments. In NICE, a reproduced CVE comprises one or more NixOS virtual machine configurations, a scripted exploitation scenario, and machine-checkable assertions that provide factual evidence of exploitation. This design facilitates sharing, validation, review, and long-term reproducibility.
Building on NICE, we construct a public archive of 56 reproduced vulnerabilities spanning multiple CWE categories, attack vectors, and target types (user-space, system software, kernel, and graphical applications), combining manually authored recipes with recipes produced by an LLM-based automated pipeline and merged after human review. We evaluate the feasibility of the automated pipeline on 110 real-world CVEs, achieving fully automated reproduction in 54.5% of the cases, at an average cost of $0.73 per CVE. The evaluation demonstrates that NICE provides a practical target for LLM-assisted recipe generation, while also identifying where human refinement or additional automation remains necessary.
NICE is applicable to security education and training (e.g., creating cyber ranges), but also to vulnerability reporting, where its reproducibility and reviewability properties can make reports easier to audit and verify.
Understanding information flows in complex systems is central to vulnerability research, yet this task quickly becomes intractable when evaluators only have access to low- level traces. Provenance graphs provide a natural abstraction for relating information transfers between processes and resources, but straightforward constructions suffer from over-linking: long- lived processes accumulate many potential inputs and outputs, and shared resources blur the relation between writers and later readers, making information flow analysis unreliable due to the high level of uncertainty. This paper presents a toolchain called ProvScope dedicated to circumventing the over-linking problem. ProvScope combines a lightweight execution-trace capture tool based on eBPF/bpftrace probes with an interactive desktop exploration application centered on State-Expanded Provenance Graphs (SEPGs). SEPGs provide a complete structure that supports (1) the reconstruction of system resources’ content to apply inter-process provenance pruning and (2) evaluator- stated implementation details of processes to apply intra-process pruning. This pruning capability of ProvScope is crucial as it allows the evaluator to identify relevant paths for vulnerability investigation in a complex system by iteratively eliminating over-linking. The paper describes the underlying model, the architecture of ProvScope, the intended evaluator workflow, and experiments highlighting the approach benefits. Index Terms—Vulnerability investigation, Information flow analysis, Provenance Graphs, causal analysis.
Presentation at SSTIC 2026 (in French)
Tools : ProvScopeApp and ProvScopeObserver
System logs contain rich information about system activity, but correctly identifying malicious events is difficult without contextual information. While sequential models like Transformers or LSTMs can process sequences of events and extract information from that context, they are neither interpretable nor explicit. In this paper, we use a neural-symbolic framework to classify process-level auditd events into the appropriate techniques of the MITRE ATT&CK® framework. We apply our approach to multiple model architectures and show that contextual logic can improve the overall F1-score, while providing interpretable per-technique corrections.
Multi-step attacks hide in system-level event streams whose volume makes manual analysis impossible. This talk argues that causal dependency between events is the right abstraction for both explaining and detecting such attacks, and reports on three steps.
The first records causality as the events happen: security-relevant system calls are captured with eBPF and ordered with event-based vector clocks, producing causal logs from which an attack can be explained by traversing the dependencies backwards from an alert. This step was presented at RESSI 2025 and CRiSIS 2025, on an SQL-injection scenario and on a command-and-control backdoor.
The second asks what follows once causality is explicit in the log: does detection still require graph representation learning? We describe a graph-free detector that keeps one recurrent state per entity, updated by causal messages, and evaluate it on the DARPA Transparent Computing datasets against a graph-based baseline. The third step is the controlled counterpart, which keeps neighbourhood aggregation under the same objective in order to measure what the graph actually contributes; it is ongoing.
The talk also covers what the evaluation made visible: how far conclusions move with the choice of metric, and defects we found in the ground truth of a widely used public dataset.
Related publications: