Data Provenance in Security and Privacy

Provenance information corresponds to essential metadata that describes the entities, users, and processes involved in the history and evolution of a data object. The benefits of tracking provenance information have been widely understood in a variety of domains; however, only recently have provenance solutions gained interest in the security community. Indeed, on the one hand, provenance allows for a reliable historical analysis enabling security-related applications such as forensic analysis and attribution of malicious activity. On the other hand, the unprecedented changes in the threat landscape place demands for securing provenance information to facilitate its trustworthiness. With the recent growth of provenance studies in security, in this work we examine the role of data provenance in security and privacy. To set this work in context, we outline fundamental principles and models of data provenance and explore how the existing studies achieve security principles. We further review the existing schemes for securing data provenance collection and manipulation known as secure provenance and the role of data provenance for security and privacy, which we refer to as threat provenance.