ProTracer: Towards Practical Provenance Tracing by Alternating Between Logging and Tainting
Year: 2016
Type: conference-paper
Abstract: Provenance tracing is a very important approach to Advanced Persistent Threat (APT) attack detection and investigation.Existing techniques either suffer from the dependence explosion problem or have non-trivial space and runtime overhead, which hinder their application in practice.We propose ProTracer, a lightweight provenance tracing system that alternates between system event logging and unit level taint propagation.The technique is built on an on-the-fly system event processing infrastructure that features a very lightweight kernel module and a sophisticated user space daemon that performs concurrent and out-of-order event processing.The evaluation with different realistic system workloads and a number of attack cases show that ProTracer only produces 13MB log data per day, and 0.84GB(Server)/2.32GB(Client) in 3 months without losing any important information.The space consumption is only < 1.28% of the state-of-the-art, 7 times smaller than an off-line garbage collection technique.The run-time overhead averages <7% for servers and <5% for regular applications.The generated attack causal graphs are a few times smaller than those by existing techniques while they are equally informative.
Authors: Shiqing Ma, Xiangyu Zhang, Dongyan Xu
Institution: Purdue University West Lafayette
Language: English
Subfield: Hardware and Architecture
Field: Computer Science
Domain: Physical Sciences
Open Access status: bronze
OpenAlex ID: W2579106964