Runtime Analysis of Whole-System Provenance
Runtime Analysis of Whole-System Provenance
复制标题
DOI：
10.1145/3243734.3243776
复制
发表时间：
2018-01
期刊：
影响因子：
--
通讯作者：
Thomas Pasquier;Xueyuan Han;Thomas Moyer;Adam Bates;O. Hermant;D. Eyers;J. Bacon;M. Seltzer
中科院分区：
文献类型：
--
作者：
Thomas Pasquier;Xueyuan Han;Thomas Moyer;Adam Bates;O. Hermant;D. Eyers;J. Bacon;M. Seltzer
确定系统入侵的根本原因和影响仍然是计算机安全的基本挑战。数字出处提供了计算系统内信息流的详细历史，将可疑事件与其根本原因联系起来。虽然现有的基于出处的审计技术提供了价值的法医分析，他们认为，这种分析只发生回顾性的。这种事后分析是不够的实时安全应用程序，此外，即使对于取证任务，以前的出处收集系统表现出较差的性能和可扩展性，危及查询响应的及时性。我们提出CamQuery，它提供了内联，实时的出处分析，使其适合于实现安全应用程序。CamQuery是一个Linux安全模块，为分析应用程序的用户空间和内核执行提供支持。我们证明了CamQuery的适用性，各种运行时的安全应用程序，包括数据丢失预防，入侵检测和法规遵从性。在评估中，我们证明了CamQuery减少了实时查询机制的延迟，同时对系统执行施加最小的开销。因此，CamQuery能够进一步部署基于出处的技术，以解决计算机安全方面的核心挑战。
Identifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of information within a computing system, connecting suspicious events to their root causes. Although existing provenance-based auditing techniques provide value in forensic analysis, they assume that such analysis takes place only retrospectively. Such post-hoc analysis is insufficient for realtime security applications; moreover, even for forensic tasks, prior provenance collection systems exhibited poor performance and scalability, jeopardizing the timeliness of query responses. We present CamQuery, which provides inline, realtime provenance analysis, making it suitable for implementing security applications. CamQuery is a Linux Security Module that offers support for both userspace and in-kernel execution of analysis applications. We demonstrate the applicability of CamQuery to a variety of runtime security applications including data loss prevention, intrusion detection, and regulatory compliance. In evaluation, we demonstrate that CamQuery reduces the latency of realtime query mechanisms, while imposing minimal overheads on system execution. CamQuery thus enables the further deployment of provenance-based technologies to address central challenges in computer security.