<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span class="Apple-tab-span" style="white-space: pre;"> </span> Provenance-based Security and Transparent Computing<br class=""> A workshop inspired by the DARPA Transparent Computing program<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span> <a href="https://sites.google.com/site/pbstc2016/" class="">https://sites.google.com/site/pbstc2016/</a><br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>Part of Provenance Week, June 6, 2016, Washington DC.<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span> <a href="http://www2.mitre.org/public/provenance2016/" class="">http://www2.mitre.org/public/provenance2016/</a><div class=""><br class=""></div><div class="">PLEASE NOTE: Registration for ProvenanceWeek and for this </div><div class="">workshop closes Friday, May 20. No extensions to this deadline are possible.<br class=""><br class="">Transparent Computing is a DARPA research program aimed at using<br class="">provenance to improve the security of computer systems. Specifically,<br class="">the program aims to use pervasive provenance tracking for data and<br class="">threads of execution to understand causality in both individual<br class="">systems and networks of systems. As a practical use case and concrete<br class="">way to demonstrate effectiveness, the program aims to use that<br class="">causality to identify and combat advanced persistent threats (APTs)<br class="">against such systems. APTs are often undetectable by policy-based<br class="">monitoring or current event log analysis techniques for two key<br class="">reasons: they act slowly (over months at a time) to gain and persist<br class="">access to target system resources; and they are careful not to violate<br class="">either system security policies or user work patterns that would<br class="">betray their presence.<br class=""><br class="">This workshop aims to provide a forum for discussing recent<br class="">developments in the Transparent Computing project and their<br class="">relationship to the broader field of provenance and security research.<br class=""><br class=""><br class="">== Program ==<div class=""><br class=""></div><div class=""> * Invited talk: "Workflow abstraction for implementing security policies", Vasa Curcin, (King's College London)</div><div class=""><div class=""><br class=""></div><div class=""> * "Combining computational provenance and anomaly detection to reveal cautious, persistent threats" David W. Archer (Galois, Inc.), James Cheney (University of Edinburgh), Hoda Eldardiry (PARC, a Xerox Company), Rui Filipe Lima Maranhão de Abreu (PARC, a Xerox Company), Alan Fern (Oregon State University)<br class=""><br class=""></div><div class=""> * "Overview to 'THEIA: Tagging and Tracking of Multilevel Host Events for Transparent Computing and Information Assurance'", Yang Ji (Georgia Institute of Technology)</div><div class=""><br class=""></div><div class=""> * "From DTrace to provenance: bridging the semantic gap", Lucian Carata, Ripduman Sohan, Robert Watson (University of</div>Cambridge), Arun Thomas (BAE Systems)<div class=""><br class=""></div><div class="">== Organizing Committee ==<br class=""><br class=""> James Cheney (chair), University of Edinburgh<br class=""> David W. Archer, Galois, Inc.<br class=""> Ashish Gehani, SRI International<br class=""> Yingbo Song, BAE Systems</div><div class=""> Mukesh Dalal, BAE Systems</div><div class=""><br class="">== About ProvenanceWeek ==<br class=""><br class="">ProvenanceWeek 2016, June 6-9, 2016, is being hosted by The MITRE<br class="">Corporation in McLean, Virginia, USA, a short metro ride from<br class="">Washington D.C. The workshops IPAW and TAPP will be co-located during<br class="">the week. The workshop "Provenance Based Security and Transparent<br class="">Computing" will take place on the morning of June 6. Entry to the<br class="">workshop is free but we need to know who is coming (note that<br class="">registrations close on May 20!). All registered attendees will be<br class="">listed on the workshop Web site. Registration is through the<br class="">Provenance Week registration page. Participants are cordially invited<br class="">to register for subsequent Provenance Week events.<br class=""><br class=""><a href="http://www2.mitre.org/public/provenance2016/registration.html" class="">http://www2.mitre.org/public/provenance2016/registration.html</a></div></div></div></body></html>