CAPT:Context-Aware Provenance Tracing for Attack Investigation

APT attacks are prolonged and have multiple stages, and they usually utilize zero-day or one-day exploits to be penetrating and stealthy. Among all kinds of security tech- niques, provenance tracing is regarded as an important approach to attack investigation, as it discloses the root cause, the attacking path, and the results of attacks. However, existing techniques either suffer from the limitation of only focusing on the log type, or are high- ly susceptible to attacks, which hinder their applications in investigating APT attacks. We present CAPT, a context-aware provenance tracing system that leverages the advantages of virtualization technologies to transparently collect system events and network events out of the target machine, and processes them in the specific host which introduces no space cost to the target. CAPT utilizes the contexts of collected events to bridge the gap between them, and provides a panoramic view to the attack investigation. Our evaluation results show that CAPT achieves the efi＇ective prov- enance tracing to the attack cases, and it only produces 0.21 MB overhead in 8 hours. With our newly-developed technology, we keep the run-time overhead averages less than 4%.

Tracing the provenance of aeolian loess in the Yangtze River Delta through zircon U–Pb age and geochemical investigations

Given the conflicts over the proposed formation mechanisms of Xiashu loess, the question of the provenance of sediments comprising the Xiashu loess in the Yangtze River Delta has not been satisfactorily resolved. In this study, the provenance of aeolian sediments of the Yangtze River Delta, China was examined by applying the detrial zircon U–Pb dating technique, Sr–Nd isotopic and trace element compositional analysis. U-Pb dating analysis was conducted on the Xiashu loess at three locations over the Yangtze River Delta, including Huangnishan(HNS) hill, Shengshan(SS) island and the Xuancheng(XC) area. The Xiashu loess and the sediments of the Yangtze River Valley share considerable similarity in their zircon U-Pb age spectra with the same main age peak and comparable age distribution. By contrast, significant differences in the age spectra, existbetween the Xiashu loess and loess deposits of Chinese Loess Plateau(CLP). Coarse grains of the Yangtze River Delta loess may have a proximal material source identical to the sediments from the Yangtze River valley. Sr–Nd isotopic values of the Xiashu loess match those from the northern margin of the Tibetan Plateau. Rare earth element ratios independent of grain size illustrate that the values from loess of the Yangtze River Delta mostly overlap with those of CLP loess. This feature implies that loess from the Yangtze River Delta has a dominant source of distant material similar as the CLP loess. As such, we conclude that multi-proxy analysis of sediments can shed new light on tracing the provenance of aeolian loess in the Yangtze River Delta.

Tracing the Provenance of the Huguangyan Maar Lake Sediments in Coastal Regions of South China

The Huguangyan Maar Lake（HML）（21°9＇N,110°17＇E）,situated on the Leizhou Peninsula in the southernmost of China's Mainland,is the deepest recent crater lake among the identified volcanic structures in the Leiqiong Volcanic Field.The bi-lobate lake.

Major and trace element geochemistry of the mid-Bay of Bengal surface sediments: implications for provenance

The major and trace elements in 110 surface sediment samples collected from the middle of the Bay of Bengal（mid-Bay of Bengal） are analyzed to investigate provenance. Si levels are highest, followed by Al, and the distributions of these two elements are identical. The average CIA＊（chemical index of alteration） value is 72.07,indicating that the degree of weathering of the sediments in the study area is intermediate between those of sediments of the Himalayan and Indian rivers. Factor analyses and discrimination function analyses imply that the two main provenances are the Himalayan and the Indian continent. The inverse model calculation of the Tinormalized element ratios of the Bay of Bengal sediments indicate an estimated average contribution of 83.5%and 16.5% from the Himalayan and peninsular Indian rivers to the study area, respectively. The Himalayan source contributes more sediment to the eastern part of the study area, whereas the western part receives more sediment from the Indian Peninsula than did the eastern part. The primary mechanisms for deposition of sediments in the study area are the transport of Himalayan matter by turbidity currents and river-diluted water and the transport of Indian matter to the study area by a surface circulation in the Bay of Bengal, particularly the East India Coastal Current.

Changing provenance of late Cenozoic sediments in the Jianghan Basin

The Yangtze River is one of the most important components of the East Asia river system. In this study, sediments in the Jianghan Basin, middle Yangtze River, were selected for trace element and rare earth element （REE） measurements, in order to decipher information on the change of sediment provenance and evolution of the Yangtze River. According to the elemental variations, the late Cenozoic sediments of the Jianghan Basin could be divided into four parts. During 2.68-2,28 Ma and 1.25-0 Ma, proveJ nance of the sediments was consistent, whereas sediments were derived from variable sources during 2.28-1.25 Ma. Comparison of the elemental compositions between the Pliocene and Quaternary sediments revealed a change in sediment source from a more felsic source area to a more basic source area around the Pliocene--Quaternary boundary. Input from the Emeishan LIP should account for this provenance change, Based on the provenance analysis of sediments in the Jianghan Basin, we infer that the Yangtze River developed into a large river with its drainage basin extended to the Emeishan LIP no later than the Pliocene-Quaternary boundary.