Investigating system intrusions with data provenance analytics