Runtime Analysis of Whole-System Provenance

Abstract

Identifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of information within a computing system, connecting suspicious events to their root causes. Although existing provenance-based auditing techniques provide value in forensic analysis, they assume that such analysis takes place only retrospectively. Such post-hoc analysis is insufficient for realtime security applications; moreover, even for forensic tasks, prior provenance collection systems exhibited poor performance and scalability, jeopardizing the timeliness of query responses.We present CamQuery, which provides inline, realtime provenance analysis, making it suitable for implementing security applications. CamQuery is a Linux Security Module that offers support for both userspace and in-kernel execution of analysis applications. We demonstrate the applicability of CamQuery to a variety of runtime security applications including data loss prevention, intrusion detection, and regulatory compliance. In evaluation, we demonstrate that CamQuery reduces the latency of realtime query mechanisms, while imposing minimal overheads on system execution. CamQuery thus enables the further deployment of provenance-based technologies to address central challenges in computer security. * Part of this work was completed at Harvard University and at the University of Cambridge.

Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats

“…We use CamFlow [100] as the reference implementation throughout the paper, although there exist other whole-system provenance implementations; in § VI, we show that UNI-CORN works seamlessly with other capture mechanisms as well. CamFlow adopts the Linux Security Modules (LSM) framework [89] to ensure high-quality, reliable recording of information flows among data objects [45], [101]. LSM eliminates race conditions (e.g., TOCTTOU attacks) by placing mediation points inside the kernel instead of at the system call interface [61].…”

“…1 only on newly-arriving vertices and on vertices whose in-coming neighborhood is affected by new edges. In provenance graphs that use multiple vertices per provenance entity or activity to represent different versions or states of the corresponding object [90], we need to compute/update only the neighborhood of the destination vertex for each new edge, because all incoming edges to a vertex arrive before any outgoing ones [101]. UNICORN takes advantage of this partial ordering to minimize computation ( Fig.…”

HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows

“…Recent studies [22], [44], [50] have used system-call level logs for real-time analytics. SLEUTH [22] presents tag-based techniques for attack detection and in-situ forensics.…”

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution

“…This line of work typically parses system logs into dependency graphs (also known as provenance graphs) that allow to derive insights and scrutinize the causal relationships between events. Several methods have been proposed to automatically recognize security incidents from these graphs [23], [45], [83], [42], [11], [93], [35], [98], [124], to more precisely and accurately reason about the stream of events [67], [75], [65], [74], [5], or to more efficiently process queries to these graphs [71], [29], [30], [54], [55], [96]. Notably, all this work fully trusts the integrity of the logs used as input to their systems.…”