CLUE
The CLUE project develops an infrastructure to detect and diagnose system anomalies in enterprise and cloud systems. These anomalies include stealthy malware and other types of hidden system anomalies. CLUE provides a diverse set of tools to find and understand such anomalies with minimal disruption to the target system.
Recent News
- Oct. 21, 2020: FMS conference talk at DIMVA 2021
- Apr. 20, 2021: FMS is accepted to DIMVA 2021
Available Work
- FMS: an enterprise analysis tool to find outdated programs and computers (paper)
- PDNS: a malware detection agent based on program DNS behaviors (paper)
- TBQL: a domain-specific language for system-behavioral queries (stream-processing paper, progressive-processing paper)
- IntroSec: a low-overhead security audit logging tool for Windows (paper)
- PerfGuard: a binary instrumentation tool for self-triggered performance diagnosis (paper)
- IntroPerf: a performance diagnosis tool using system event logs (paper)
Ongoing Work
- Telemetry
publications
2021
2020
2019
2018
SAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detection
In Security 2018 (award paper) [ pdf :: slides :: bibtex ]
In Security 2018 (award paper) [ pdf :: slides :: bibtex ]
2016
2015
Accurate, Low Cost and Instrumentation-Free Security Audit Logging for Windows
In ACSAC 2015 [ pdf :: slides :: bibtex ]
In ACSAC 2015 [ pdf :: slides :: bibtex ]
2014
IntroPerf: Transparent Context-Sensitive Multi-Layer Performance Inference using System Stack Traces
In SIGMETRICS 2014 [ pdf :: slides :: bibtex ]
In SIGMETRICS 2014 [ pdf :: slides :: bibtex ]
sponsors