Host intrusion detection relies on uncertain timing assumptions
SoK: Timestamps Are Not a Time Model: Rethinking Temporal Reasoning in Host-Based Intrusion Detection
Cryptography and SecurityArtificial IntelligenceLogic in Computer Science
Summary
Host-based intrusion detection systems try to spot cyberattacks by looking at the order and timing of events recorded on a computer. This paper shows that these systems often make hidden or unstated assumptions about how clocks work and how trustworthy the recorded data is. The authors identify important parts of how time is modeled in these systems and check many existing papers and tools to see if they state or meet these assumptions. They find large gaps, like ignoring whether data was deleted or manipulated, and suggest challenges for improving how these systems reason about time and evidence.
What this means in practice
- •For security operations teams: Refine detection rules to explicitly consider clock errors and data delays when correlating security events from host audit logs.
- •For cyber forensics analysts: Develop investigation procedures that identify which conclusions remain valid even if audit records are missing, delayed, or forged.
A survey. It maps existing work.
Authors
Rene Heinzl, Markus Nissl
Abstract
Host-based intrusion detectors order events, window audit streams and sequence attack stages by their timestamps. Every conclusion they draw therefore rests on assumptions about clocks, delivery, entity identity and the integrity of the evidence, and most of these assumptions go unstated. This Systematization of Knowledge (SoK) makes them explicit. Drawing on temporal databases, stream processing and runtime verification, we distill five components of a time model, together with a checklist of evidence assumptions and four levels of guarantee, and walk through a running campaign with them. A documented search yields fifteen families of detection and investigation. For papers selected by screening role and period, plus named systems and landmarks, we check the stated assumptions in the full texts, and we assess eleven temporal knowledge representation and reasoning (KRR) formalisms and a learned baseline on nine attack patterns. Some early alert correlators stated clock and delivery assumptions, and forensics measures clock error. Current provenance-based detectors state no clock bound. Four audited papers describe input-ordering conditions or conventions, but none specifies conditions for conclusion validity across a stated class of delivery failures. In the selected provenance-based systems, campaign composition uses system-specific procedures or objectives, learned state, causal graph queries or language models, and beyond CEP-based query systems, we found no temporal rule language or stream reasoner from KRR applied to host audit data. In 28 of 38 audited provenance-era detector papers, capture or stored evidence is trusted or its manipulation is placed out of scope, and none says which conclusions survive deleted, delayed or forged records. Five open challenges follow from these gaps.