CAREER: Scalable Information Flow Monitoring and Enforcement through Data Provenance Unification

系统入侵变得更加微妙和复杂。攻击者现在在发动毁灭性攻击之前，会长时间地秘密观察和探测系统。在这样的环境中，系统管理员识别可疑事件、将这些事件与攻击模式相关联并确定适当的响应变得极其困难。数据起源是一种以因果关系图的形式对系统执行进行建模的方法，允许调查人员跟踪数据对象的祖先并识别看似独立的事件之间的关系。建议的工作的目标是开发技术，使使用数据出处作为一个富有表现力的和高效的监控工具，在大型分布式系统。这些机制将实现前所未有的能力，以推理系统事件，集中监控数据中心内的活动，并基于历史数据流表达安全属性的细粒度实施。将通过Linux出处网站向更广泛的社区提供研究和软件制品，拟议的工作将审查与表现力和可伸缩性有关的主要挑战，这些挑战目前阻碍了基于出处的审计技术的进一步扩散。为了解决传统上阻止系统层审计能够解释更高级别的应用程序行为的语义差距，该项目追求通用起源机制的设计，该机制利用二进制分析来透明地识别孤立的应用程序层日志记录活动，提取其语义，并将信息移植到编码整个系统执行的因果关系图上。语法归纳技术将被用来克服来源的巨大存储负担，并为数据中心提供可扩展的中央监控框架。在丰富系统层审计并通过来源跟踪实现可疑活动的有效通信之后，数据来源将被集成到执法机制中，以解决关键的安全挑战，包括法规遵从性，信息流控制和故障归因。最先进的基于来源的追踪和执行技术的进步应该为当今复杂计算系统中的数据流推理建立一个新的基线。该奖项反映了NSF的法定使命，并被认为值得通过使用基金会的知识价值和更广泛的影响审查标准进行评估来支持。

System intrusions have becoming more subtle and complex. Attackers now covertly observe and probe systems for prolonged periods before launching devastating attacks. In such an environment, it has grown prohibitively difficult for system administrators to identify suspicious events, correlate these events into an attack pattern, and determine an appropriate response. Data Provenance is a method of modeling a system's execution in the form of a causal relationship graph, allowing investigators to trace the ancestry of data objects and identify relationships between seemingly independent events. The goal of the proposed work is to develop techniques that enable the use of data provenance as an expressive and efficient monitoring tool in large distributed systems. These mechanisms will enable unprecedented capability to reason about system events, centrally monitor activities within data centers, and express fine-grained enforcement of security properties based on the historical flow of data. Research and software artifacts will be made available to the broader community through the Linux provenance web site.The proposed work will examine central challenges related to expressivity and scalability that currently prevent the further proliferation of provenance-based auditing techniques. To address the semantic gap that has traditionally prevented system-layer auditing from being able to explain higher-level application behaviors, this project pursues the design of universal provenance mechanisms that leverage binary analysis to transparently identify siloed application-layer logging activities, extract their semantics, and graft the information onto a causal relationship graph that encodes the entire system's execution. Grammar induction techniques will be leveraged to overcome the tremendous storage burden of provenance and provide a scalable central monitoring framework for data centers. After enriching system-layer auditing and enabling the efficient communication of suspicious activities via provenance traces, data provenance will be integrated into enforcement mechanisms to address critical security challenges including regulatory compliance, information flow control, and fault attribution. The advancement of state-of-the-art of provenance-based tracing and enforcement should establish a new baseline for reasoning about the flow of data in today's complex computing systems.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.