A Dataset of Kernel Exploits Represented as System Provenance Graphs

CONTEXTS Dataset (A Dataset of Kernel Exploits Represented as Provenance Graphs)

This repository contains datasets generated and used for testing CONTEXTS [1]. The datasets are in the form of provenance graphs captured by SPADE during system execution. The dataset includes the exploitation of kernel vulnerabilities, where: 

• All provenance graphs are initially pruned based on the Initial Pruning step of CONTEXTS.
• The identified Points of Interest, Waypoints, and Ground Truth are annotated on the provenance graph using the tags POI, WP, and GT, respectively.
• For each dataset, the query generated by CONTEXTS is provided.

[1] Sareh Mohammadi, Hugo Kermabon-Bobinnec, Azadeh Tabiban, Lingyu Wang, Tomás Navarro Múnera, Yosr Jarraya, "CONnecting The EXtra doTS (CONTEXTS): Correlating External Information about Point of Interest for Attack Investigation." in IEEE Symposium on Security and Privacy (S&P), 2025.