Detecting System Anomalies Using Kernel-level Data Provenance