Provenance-based intrusion detection is challenged by the complexity of attacks and underlying systems. We aim to build adaptive frameworks that reduce computation while improving accuracy.

Provenance analysis is both storage and labor intensive, and current solutions struggle to scale with interconnected systems. To this end, we aim to build more efficient data collection and analysis frameworks.

AI-equipped attackers can undermine the robustness of intrusion detection by evading existing defenses. We aim to address this by studying such attackers and detecting their evasion. 

O-RAN advances 5G networks with agile, programmable architectures, but this flexibility also increases security risks. Our research aims to improve attack investigation in such complex and dynamic environments.