# Practical Whole-System Provenance Capture

arXiv: https://arxiv.org/abs/1711.05296 · HTML: https://mlsanity.com/paper/1711.05296/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Nov 2017.

## Built on by (most cited first, 19 of 19)

- [Formal Policy Enforcement for Real-World Agentic Systems](https://mlsanity.com/paper/2602.16708/) (2026)
- [Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance](https://mlsanity.com/paper/2308.05034/) (2023)
- [threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learning](https://mlsanity.com/paper/2111.04333/) (2021)
- [MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning](https://mlsanity.com/paper/2310.09831/) (2023)
- [Agent libOS: A Runtime Substrate for Capability-Controlled Self-Evolving LLM Agents](https://mlsanity.com/paper/2606.03895/) (2026)
- [ANUBIS: A Provenance Graph-Based Framework for Advanced Persistent Threat Detection](https://mlsanity.com/paper/2112.11032/) (2021)
- [OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Prompting](https://mlsanity.com/paper/2503.03108/) (2025)
- [DeepStage: Learning Autonomous Defense Policies Against Multi-Stage APT Campaigns](https://mlsanity.com/paper/2603.16969/) (2026)
- [Deep Learning-based Intrusion Detection Systems: A Survey](https://mlsanity.com/paper/2504.07839/) (2025)
- [TBDetector:Transformer-Based Detector for Advanced Persistent Threats with Provenance Graph](https://mlsanity.com/paper/2304.02838/) (2023)
- [PIDSMaker: Building and Evaluating Provenance-based Intrusion Detection Systems](https://mlsanity.com/paper/2601.22983/) (2026)
- [Observability for Delegated Execution in Agentic AI Systems](https://mlsanity.com/paper/2606.09692/) (2026)
- [Flurry: a Fast Framework for Reproducible Multi-layered Provenance Graph Representation Learning](https://mlsanity.com/paper/2203.02744/) (2022)
- [Agentic Data Environments](https://mlsanity.com/paper/2607.07397/) (2026)
- [How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection](https://mlsanity.com/paper/2608.01454/) (2026)
- [AUDITA: certified auditing and causal attribution of adverse outcomes in autonomous multi-agent systems](https://mlsanity.com/paper/2608.22160/) (2026)
- [Structurally Close, Temporally Distant: Measuring Security Exposure in Long-Horizon LLM Agents](https://mlsanity.com/paper/2609.05911/) (2026)
- [Runtime Authorization Consistency Checking for MCP-based Agentic Workflows](https://mlsanity.com/paper/2609.23498/) (2026)
- [Hearsay: Can an Auditor Trust the Record a Deployed Agent Harness Writes?](https://mlsanity.com/paper/2609.32495/) (2026)

## Abstract (arXiv)

Data provenance describes how data came to be in its present form. It includes data sources and the transformations that have been applied to them. Data provenance has many uses, from forensics and security to aiding the reproducibility of scientific experiments. We present CamFlow, a whole-system provenance capture mechanism that integrates easily into a PaaS offering. While there have been several prior whole-system provenance systems that captured a comprehensive, systemic and ubiquitous record of a system's behavior, none have been widely adopted. They either A) impose too much overhead, B) are designed for long-outdated kernel releases and are hard to port to current systems, C) generate too much data, or D) are designed for a single system. CamFlow addresses these shortcoming by: 1) leveraging the latest kernel design advances to achieve efficiency; 2) using a self-contained, easily maintainable implementation relying on a Linux Security Module, NetFilter, and other existing kernel facilities; 3) providing a mechanism to tailor the captured provenance data to the needs of the application; and 4) making it easy to integrate provenance across distributed systems. The provenance we capture is streamed and consumed by tenant-built auditor applications. We illustrate the usability of our implementation by describing three such applications: demonstrating compliance with data regulations; performing fault/intrusion detection; and implementing data loss prevention. We also show how CamFlow can be leveraged to capture meaningful provenance without modifying existing applications.