Provenance-Based Endpoint Detection and Response (P-EDR) systems are deemed crucial for future APT defenses. Despite the fact that numerous new techniques to improve P-EDR systems have been proposed in academia, it is still unclear whether the industry will adopt P-EDR systems and what improvements the industry desires for P-EDR systems. To this end, we conduct the first set of systematic studies on the effectiveness and the limitations of P-EDR systems. Our study consists of four components: a one-to-one interview, an online questionnaire study, a survey of the relevant literature, and a systematic measurement study. Our research indicates that all industry experts consider P-EDR systems to be more effective than conventional Endpoint Detection and Response (EDR) systems. However, industry experts are concerned about the operating cost of P-EDR systems. In addition, our research reveals three significant gaps between academia and industry: (1) overlooking client-side overhead; (2) imbalanced alarm triage cost and interpretation cost; and (3) excessive server-side memory consumption. This paper's findings provide objective data on the effectiveness of P-EDR systems and how much improvements are needed to adopt P-EDR systems in industry.

翻译：基于溯源的端点检测与响应（P-EDR）系统被视为未来高级持续性威胁（APT）防御的关键。尽管学术界已提出众多改进P-EDR系统的新技术，但工业界是否会采用P-EDR系统以及工业界期望对P-EDR系统进行哪些改进，目前仍不明确。为此，我们开展了首轮关于P-EDR系统有效性与局限性的系统研究。我们的研究包含四个部分：一对一访谈、在线问卷调查、相关文献综述以及系统性测量研究。研究结果表明，所有工业专家均认为P-EDR系统比传统端点检测与响应（EDR）系统更有效。然而，工业专家对P-EDR系统的运营成本表示担忧。此外，我们的研究揭示了学术界与工业界之间的三个显著差距：(1) 忽视客户端开销；(2) 告警分类成本与解释成本失衡；(3) 服务端内存消耗过高。本文的研究结果为P-EDR系统的有效性以及工业界采用P-EDR系统所需改进的程度提供了客观数据。