ALASTOR: Reconstructing the Provenance of Serverless Intrusions
ALASTOR: Reconstructing the Provenance of Serverless Intrusions
复制标题
DOI：
--
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Pubali Datta;Isaac Polinsky;M. A. Inam;Adam Bates;W. Enck
中科院分区：
文献类型：
--
作者：
Pubali Datta;Isaac Polinsky;M. A. Inam;Adam Bates;W. Enck
无服务器计算将开发人员从管理自己的平台和基础设施的负担中解放出来，使他们能够快速原型化和部署应用程序。然而，尽管无服务器的流行度激增，但它引发了一些令人担忧的安全问题。其中之一是调查入侵的困难-通过将传统应用程序分解为短暂的可重入功能，无服务器使攻击者能够将其活动隐藏在合法的工作流程中，甚至通过滥用热容器重用策略来破坏因果路径来阻止根本原因分析。不幸的是，传统的系统审计方法和商业无服务器安全产品都无法提供准确跟踪这些新威胁所需的透明度。在这项工作中，我们提出了一个LASTOR，一个基于出处的审计框架，可以精确跟踪无服务器应用程序中的可疑事件。LASTOR记录系统层和应用层的功能活动，以捕捉每个功能实例行为的整体画面。然后，它在无服务器平台内的中央存储库中聚合来自不同功能的起源，将其拼接在一起，以生成复杂功能工作流程的全局数据起源图。LASTOR是功能和语言不可知的，可以很容易地集成到现有的无服务器平台中，只需很少的修改。我们为OpenFaaS平台实现了LAS TOR，并使用成熟的Nordstrom Hello，Retail！应用程序，发现在这个过程中，LASTOR强加了可管理的开销（13.74%），以换取与商业可用的监控工具相比显着提高的取证能力。据我们所知，A LASTOR是第一个专门为满足无服务器平台的操作要求而设计的审计框架。
Serverless computing has freed developers from the burden of managing their own platform and infrastructure, allowing them to rapidly prototype and deploy applications. Despite its surging popularity, however, serverless raises a number of concerning security implications. Among them is the diffi-culty of investigating intrusions – by decomposing traditional applications into ephemeral re-entrant functions, serverless has enabled attackers to conceal their activities within legitimate workflows, and even prevent root cause analysis by abusing warm container reuse policies to break causal paths. Unfortunately, neither traditional approaches to system auditing nor commercial serverless security products provide the transparency needed to accurately track these novel threats. In this work, we propose A LASTOR , a provenance-based auditing framework that enables precise tracing of suspicious events in serverless applications. A LASTOR records function activity at both system and application layers to capture a holistic picture of each function instances’ behavior. It then aggregates provenance from different functions at a central repository within the serverless platform, stitching it together to produce a global data provenance graph of complex function workflows. A LASTOR is both function and language-agnostic, and can easily be integrated into existing serverless platforms with minimal modification. We implement A LAS TOR for the OpenFaaS platform and evaluate its performance using the well-established Nordstrom Hello,Retail! application, discovering in the process that A LASTOR imposes man-ageable overheads (13.74%), in exchange for significantly improved forensic capabilities as compared to commercially-available monitoring tools. To our knowledge, A LASTOR is the first auditing framework specifically designed to satisfy the operational requirements of serverless platforms.