Kernel-Supported Cost-Effective Audit Logging for Causality Tracking

Authors: 

Shiqing Ma, Purdue University; Juan Zhai, Nanjing University; Yonghwi Kwon, Purdue University; Kyu Hyung Lee, University of Georgia; Xiangyu Zhang, Purdue University; Gabriela Ciocarlie, Ashish Gehani, and Vinod Yegneswaran, SRI International; Dongyan Xu, Purdue University; Somesh Jha, University of Wisconsin-Madison

Abstract: 

The Linux Audit system is widely used as a causality tracking system in real-world deployments for problem diagnosis and forensic analysis. However, it has poor performance. We perform a comprehensive analysis on the Linux Audit system and find that it suffers from high runtime and storage overheads due to the large volume of redundant events. To address these shortcomings, we propose an in-kernel cache-based online log-reduction system to enable high-performance audit logging. It features a multi-layer caching scheme distributed in various kernel data structures, and uses the caches to detect and suppress redundant events. Our technique is designed to reduce the runtime overhead caused by transferring, processing, and writing logs, as well as the space overhead caused by storing them on disk. Compared to existing log reduction techniques that first generate the huge raw logs before reduction, our technique avoids generating redundant events at the first place. Our experimental results of the prototype KCAL (Kernel-supported Cost-effective Audit Logging) on one-month real-world workloads show that KCAL can reduce the runtime overhead from 40+% to 15-%, and reduce space consumption by 90% on average. KCAL achieves such a large reduction with 4% CPU consumption on average, whereas a state-of-the-art user space log-reduction technique has to occupy a processor with 95+% CPU consumption all the time.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

Presentation Audio

BibTeX
@inproceedings {216025,
author = {Shiqing Ma and Juan Zhai and Yonghwi Kwon and Kyu Hyung Lee and Xiangyu Zhang and Gabriela Ciocarlie and Ashish Gehani and Vinod Yegneswaran and Dongyan Xu and Somesh Jha},
title = {Kernel-Supported Cost-Effective Audit Logging for Causality Tracking},
booktitle = {2018 {USENIX} Annual Technical Conference ({USENIX} {ATC} 18)},
year = {2018},
isbn = {978-1-931971-44-7},
address = {Boston, MA},
pages = {241--254},
url = {https://www.usenix.org/conference/atc18/presentation/ma-shiqing},
publisher = {{USENIX} Association},
}