  System auditing has emerged as a key approach for monitoring system call
events and investigating sophisticated attacks. Based on the collected audit
logs, research has proposed to search for attack patterns or track the causal
dependencies of system events to reveal the attack sequence. However, existing
approaches either cannot reveal long-range attack sequences or suffer from the
dependency explosion problem due to a lack of focus on attack-relevant parts,
and thus are insufficient for investigating complex attacks.
  To bridge the gap, we propose Zebra, a system that synergistically integrates
attack pattern search and causal dependency tracking for efficient attack
investigation. With Zebra, security analysts can alternate between search and
tracking to reveal the entire attack sequence in a progressive, user-guided
manner, while mitigating the dependency explosion problem by prioritizing the
attack-relevant parts. To enable this, Zebra provides (1) an expressive and
concise domain-specific language, Tstl, for performing various types of search
and tracking analyses, and (2) an optimized language execution engine for
efficient execution over a big amount of auditing data. Evaluations on a broad
set of attack cases demonstrate the effectiveness of Zebra in facilitating a
timely attack investigation.
