Analysing system behaviour by automatic benchmarking of system-level provenance

System-level provenance is of widespread interest for applications such as security enforcement and information protection. However, testing the correctness or completeness of provenance systems is challenging. In some cases, there is not even a clear consensus about what behaviour is correct. This work presents the study of system behaviour through the analysis of system-level provenance and the provenance systems that collect them. Besides, an automated tool, ProvMark is presented for the automation of the process and provides an additional layer of expressiveness benchmarking on existing provenance systems and their provenance result. This helps to understand patterns of system behaviour for security and other applications. It also allows provenance system developers to verify their tools and allows end-users to compare the tools at the same level to choose a suitable one for their purposes.