The Experts below are selected from a list of 19845 Experts worldwide ranked by ideXlab platform

Thomas Moyer - One of the best experts on this subject based on the ideXlab platform.

  • runtime analysis of whole system provenance
    arXiv: Cryptography and Security, 2018
    Co-Authors: Thomas Pasquier, Xueyuan Han, Thomas Moyer, Adam Bates, Olivier Hermant, David Eyers, Jean Bacon, Margo Seltzer
    Abstract:

    Identifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of information within a computing system, connecting suspicious events to their root causes. Although existing provenance-based auditing techniques provide value in forensic analysis, they assume that such analysis takes place only retrospectively. Such post-hoc analysis is insufficient for realtime security applications, moreover, even for forensic tasks, prior provenance collection systems exhibited poor performance and scalability, jeopardizing the timeliness of query responses. We present CamQuery, which provides inline, realtime provenance analysis, making it suitable for implementing security applications. CamQuery is a Linux Security Module that offers support for both userspace and in-kernel execution of analysis applications. We demonstrate the applicability of CamQuery to a variety of runtime security applications including Data Loss Prevention, intrusion detection, and regulatory compliance. In evaluation, we demonstrate that CamQuery reduces the latency of realtime query mechanisms, while imposing minimal overheads on system execution. CamQuery thus enables the further deployment of provenance-based technologies to address central challenges in computer security.

  • practical whole system provenance capture
    arXiv: Cryptography and Security, 2017
    Co-Authors: Thomas Pasquier, Xueyuan Han, Thomas Moyer, David Eyers, Margo Seltzer, Mark A Goldstein, Jean Bacon
    Abstract:

    Data provenance describes how Data came to be in its present form. It includes Data sources and the transformations that have been applied to them. Data provenance has many uses, from forensics and security to aiding the reproducibility of scientific experiments. We present CamFlow, a whole-system provenance capture mechanism that integrates easily into a PaaS offering. While there have been several prior whole-system provenance systems that captured a comprehensive, systemic and ubiquitous record of a system's behavior, none have been widely adopted. They either A) impose too much overhead, B) are designed for long-outdated kernel releases and are hard to port to current systems, C) generate too much Data, or D) are designed for a single system. CamFlow addresses these shortcoming by: 1) leveraging the latest kernel design advances to achieve efficiency; 2) using a self-contained, easily maintainable implementation relying on a Linux Security Module, NetFilter, and other existing kernel facilities; 3) providing a mechanism to tailor the captured provenance Data to the needs of the application; and 4) making it easy to integrate provenance across distributed systems. The provenance we capture is streamed and consumed by tenant-built auditor applications. We illustrate the usability of our implementation by describing three such applications: demonstrating compliance with Data regulations; performing fault/intrusion detection; and implementing Data Loss Prevention. We also show how CamFlow can be leveraged to capture meaningful provenance without modifying existing applications.

  • trustworthy whole system provenance for the linux kernel
    USENIX Security Symposium, 2015
    Co-Authors: Adam Bates, Dave Tian, Kevin R B Butler, Thomas Moyer
    Abstract:

    In a provenance-aware system, mechanisms gather and report metaData that describes the history of each object being processed on the system, allowing users to understand how Data objects came to exist in their present state. However, while past work has demonstrated the usefulness of provenance, less attention has been given to securing provenance-aware systems. Provenance itself is a ripe attack vector, and its authenticity and integrity must be guaranteed before it can be put to use. We present Linux Provenance Modules (LPM), the first general framework for the development of provenance-aware systems. We demonstrate that LPM creates a trusted provenance-aware execution environment, collecting complete whole-system provenance while imposing as little as 2.7% performance overhead on normal system operation. LPM introduces new mechanisms for secure provenance layering and authenticated communication between provenance-aware hosts, and also interoperates with existing mechanisms to provide strong security assurances. To demonstrate the potential uses of LPM, we design a Provenance-Based Data Loss Prevention (PB-DLP) system. We implement PBDLP as a file transfer application that blocks the transmission of files derived from sensitive ancestors while imposing just tens of milliseconds overhead. LPM is the first step towards widespread deployment of trustworthy provenance-aware applications.

Seltzer Margo - One of the best experts on this subject based on the ideXlab platform.

  • Runtime Analysis of Whole-System Provenance
    2018
    Co-Authors: Pasquier Thomas, Han Xueyuan, Moyer Thomas, Bates Adam, Hermant Olivier, Eyers David, Bacon Jean, Seltzer Margo
    Abstract:

    Identifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of information within a computing system, connecting suspicious events to their root causes. Although existing provenance-based auditing techniques provide value in forensic analysis, they assume that such analysis takes place only retrospectively. Such post-hoc analysis is insufficient for realtime security applications, moreover, even for forensic tasks, prior provenance collection systems exhibited poor performance and scalability, jeopardizing the timeliness of query responses. We present CamQuery, which provides inline, realtime provenance analysis, making it suitable for implementing security applications. CamQuery is a Linux Security Module that offers support for both userspace and in-kernel execution of analysis applications. We demonstrate the applicability of CamQuery to a variety of runtime security applications including Data Loss Prevention, intrusion detection, and regulatory compliance. In evaluation, we demonstrate that CamQuery reduces the latency of realtime query mechanisms, while imposing minimal overheads on system execution. CamQuery thus enables the further deployment of provenance-based technologies to address central challenges in computer security.Comment: 16 pages, 12 figures, 25th ACM Conference on Computer and Communications Security 201

  • Runtime Analysis of Whole-System Provenance
    HAL CCSD, 2018
    Co-Authors: Pasquier Thomas, Han Xueyuan, Moyer Thomas, Bates Adam, Hermant Olivier, Eyers David, Bacon Jean, Seltzer Margo
    Abstract:

    International audienceIdentifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of information within a computing system, connecting suspicious events to their root causes.Although existing provenance-based auditing techniques provide value in forensic analysis, they assume that such analysis takes place only retrospectively. Such post-hoc analysis is insufficient for realtime security applications; moreover, even for forensic tasks, prior provenance collection systems exhibited poor performance and scalability, jeopardizing the timeliness of query responses.We present CamQuery, which provides inline, realtime provenance analysis, making it suitable for implementing security applications. CamQuery is a Linux Security Module that offers support for both userspace and in-kernel execution of analysis applications. We demonstrate the applicability of CamQuery to a variety of runtime security applications including Data Loss Prevention, intrusion detection, and regulatory compliance. In evaluation, we demonstrate thatCamQuery reduces the latency of realtime query mechanisms, while imposing minimal overheads on system execution. CamQuery thus enables the further deployment of provenance-based technologies to address central challenges in computer security. Preprint: the final version of this paper will appear in the proceedings of the 25th ACM Conference on Computer and Communications Security in October 2018 (https://www.sigsac.org/ccs/CCS2018/)

  • Practical whole-system provenance capture
    'Association for Computing Machinery (ACM)', 2018
    Co-Authors: Pasquier Thomas, Moyer Thomas, Eyers David, Seltzer Margo, Han, Xueyuan Michael, Goldstein Mark, Bacon Jean
    Abstract:

    Data provenance describes how Data came to be in its present form. It includes Data sources and the transformations that have been applied to them. Data provenance has many uses, from forensics and security to aiding the reproducibility of scientific experiments. We present CamFlow, a whole-system provenance capture mechanism that integrates easily into a PaaS offering. While there have been several prior whole-system provenance systems that captured a comprehensive, systemic and ubiquitous record of a system’s behavior, none have been widely adopted. They either A) impose too much overhead, B) are designed for long-outdated kernel releases and are hard to port to current systems, C) generate too much Data, or D) are designed for a single system. CamFlow addresses these shortcoming by: 1) leveraging the latest kernel design advances to achieve efficiency; 2) using a self-contained, easily maintainable implementation relying on a Linux Security Module, NetFilter, and other existing kernel facilities; 3) providing a mechanism to tailor the captured provenance Data to the needs of the application; and 4) making it easy to integrate provenance across distributed systems. The provenance we capture is streamed and consumed by tenant-built auditor applications. We illustrate the usability of our implementation by describing three such applications: demonstrating compliance with Data regulations; performing fault/intrusion detection; and implementing Data Loss Prevention. We also show how CamFlow can be leveraged to capture meaningful provenance without modifying existing applications.Engineering and Applied Science

  • Practical Whole-System Provenance Capture
    'Association for Computing Machinery (ACM)', 2017
    Co-Authors: Pasquier Thomas, Han Xueyuan, Moyer Thomas, Eyers David, Seltzer Margo, Goldstein Mark, Bacon Jean
    Abstract:

    Data provenance describes how Data came to be in its present form. It includes Data sources and the transformations that have been applied to them. Data provenance has many uses, from forensics and security to aiding the reproducibility of scientific experiments. We present CamFlow, a whole-system provenance capture mechanism that integrates easily into a PaaS offering. While there have been several prior whole-system provenance systems that captured a comprehensive, systemic and ubiquitous record of a system's behavior, none have been widely adopted. They either A) impose too much overhead, B) are designed for long-outdated kernel releases and are hard to port to current systems, C) generate too much Data, or D) are designed for a single system. CamFlow addresses these shortcoming by: 1) leveraging the latest kernel design advances to achieve efficiency; 2) using a self-contained, easily maintainable implementation relying on a Linux Security Module, NetFilter, and other existing kernel facilities; 3) providing a mechanism to tailor the captured provenance Data to the needs of the application; and 4) making it easy to integrate provenance across distributed systems. The provenance we capture is streamed and consumed by tenant-built auditor applications. We illustrate the usability of our implementation by describing three such applications: demonstrating compliance with Data regulations; performing fault/intrusion detection; and implementing Data Loss Prevention. We also show how CamFlow can be leveraged to capture meaningful provenance without modifying existing applications.Comment: 15 pages, 7 figure

Bacon Jean - One of the best experts on this subject based on the ideXlab platform.

  • Runtime Analysis of Whole-System Provenance
    2018
    Co-Authors: Pasquier Thomas, Han Xueyuan, Moyer Thomas, Bates Adam, Hermant Olivier, Eyers David, Bacon Jean, Seltzer Margo
    Abstract:

    Identifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of information within a computing system, connecting suspicious events to their root causes. Although existing provenance-based auditing techniques provide value in forensic analysis, they assume that such analysis takes place only retrospectively. Such post-hoc analysis is insufficient for realtime security applications, moreover, even for forensic tasks, prior provenance collection systems exhibited poor performance and scalability, jeopardizing the timeliness of query responses. We present CamQuery, which provides inline, realtime provenance analysis, making it suitable for implementing security applications. CamQuery is a Linux Security Module that offers support for both userspace and in-kernel execution of analysis applications. We demonstrate the applicability of CamQuery to a variety of runtime security applications including Data Loss Prevention, intrusion detection, and regulatory compliance. In evaluation, we demonstrate that CamQuery reduces the latency of realtime query mechanisms, while imposing minimal overheads on system execution. CamQuery thus enables the further deployment of provenance-based technologies to address central challenges in computer security.Comment: 16 pages, 12 figures, 25th ACM Conference on Computer and Communications Security 201

  • Runtime Analysis of Whole-System Provenance
    HAL CCSD, 2018
    Co-Authors: Pasquier Thomas, Han Xueyuan, Moyer Thomas, Bates Adam, Hermant Olivier, Eyers David, Bacon Jean, Seltzer Margo
    Abstract:

    International audienceIdentifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of information within a computing system, connecting suspicious events to their root causes.Although existing provenance-based auditing techniques provide value in forensic analysis, they assume that such analysis takes place only retrospectively. Such post-hoc analysis is insufficient for realtime security applications; moreover, even for forensic tasks, prior provenance collection systems exhibited poor performance and scalability, jeopardizing the timeliness of query responses.We present CamQuery, which provides inline, realtime provenance analysis, making it suitable for implementing security applications. CamQuery is a Linux Security Module that offers support for both userspace and in-kernel execution of analysis applications. We demonstrate the applicability of CamQuery to a variety of runtime security applications including Data Loss Prevention, intrusion detection, and regulatory compliance. In evaluation, we demonstrate thatCamQuery reduces the latency of realtime query mechanisms, while imposing minimal overheads on system execution. CamQuery thus enables the further deployment of provenance-based technologies to address central challenges in computer security. Preprint: the final version of this paper will appear in the proceedings of the 25th ACM Conference on Computer and Communications Security in October 2018 (https://www.sigsac.org/ccs/CCS2018/)

  • Practical whole-system provenance capture
    'Association for Computing Machinery (ACM)', 2018
    Co-Authors: Pasquier Thomas, Moyer Thomas, Eyers David, Seltzer Margo, Han, Xueyuan Michael, Goldstein Mark, Bacon Jean
    Abstract:

    Data provenance describes how Data came to be in its present form. It includes Data sources and the transformations that have been applied to them. Data provenance has many uses, from forensics and security to aiding the reproducibility of scientific experiments. We present CamFlow, a whole-system provenance capture mechanism that integrates easily into a PaaS offering. While there have been several prior whole-system provenance systems that captured a comprehensive, systemic and ubiquitous record of a system’s behavior, none have been widely adopted. They either A) impose too much overhead, B) are designed for long-outdated kernel releases and are hard to port to current systems, C) generate too much Data, or D) are designed for a single system. CamFlow addresses these shortcoming by: 1) leveraging the latest kernel design advances to achieve efficiency; 2) using a self-contained, easily maintainable implementation relying on a Linux Security Module, NetFilter, and other existing kernel facilities; 3) providing a mechanism to tailor the captured provenance Data to the needs of the application; and 4) making it easy to integrate provenance across distributed systems. The provenance we capture is streamed and consumed by tenant-built auditor applications. We illustrate the usability of our implementation by describing three such applications: demonstrating compliance with Data regulations; performing fault/intrusion detection; and implementing Data Loss Prevention. We also show how CamFlow can be leveraged to capture meaningful provenance without modifying existing applications.Engineering and Applied Science

  • Practical Whole-System Provenance Capture
    'Association for Computing Machinery (ACM)', 2017
    Co-Authors: Pasquier Thomas, Han Xueyuan, Moyer Thomas, Eyers David, Seltzer Margo, Goldstein Mark, Bacon Jean
    Abstract:

    Data provenance describes how Data came to be in its present form. It includes Data sources and the transformations that have been applied to them. Data provenance has many uses, from forensics and security to aiding the reproducibility of scientific experiments. We present CamFlow, a whole-system provenance capture mechanism that integrates easily into a PaaS offering. While there have been several prior whole-system provenance systems that captured a comprehensive, systemic and ubiquitous record of a system's behavior, none have been widely adopted. They either A) impose too much overhead, B) are designed for long-outdated kernel releases and are hard to port to current systems, C) generate too much Data, or D) are designed for a single system. CamFlow addresses these shortcoming by: 1) leveraging the latest kernel design advances to achieve efficiency; 2) using a self-contained, easily maintainable implementation relying on a Linux Security Module, NetFilter, and other existing kernel facilities; 3) providing a mechanism to tailor the captured provenance Data to the needs of the application; and 4) making it easy to integrate provenance across distributed systems. The provenance we capture is streamed and consumed by tenant-built auditor applications. We illustrate the usability of our implementation by describing three such applications: demonstrating compliance with Data regulations; performing fault/intrusion detection; and implementing Data Loss Prevention. We also show how CamFlow can be leveraged to capture meaningful provenance without modifying existing applications.Comment: 15 pages, 7 figure

Pasquier Thomas - One of the best experts on this subject based on the ideXlab platform.

  • Runtime Analysis of Whole-System Provenance
    2018
    Co-Authors: Pasquier Thomas, Han Xueyuan, Moyer Thomas, Bates Adam, Hermant Olivier, Eyers David, Bacon Jean, Seltzer Margo
    Abstract:

    Identifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of information within a computing system, connecting suspicious events to their root causes. Although existing provenance-based auditing techniques provide value in forensic analysis, they assume that such analysis takes place only retrospectively. Such post-hoc analysis is insufficient for realtime security applications, moreover, even for forensic tasks, prior provenance collection systems exhibited poor performance and scalability, jeopardizing the timeliness of query responses. We present CamQuery, which provides inline, realtime provenance analysis, making it suitable for implementing security applications. CamQuery is a Linux Security Module that offers support for both userspace and in-kernel execution of analysis applications. We demonstrate the applicability of CamQuery to a variety of runtime security applications including Data Loss Prevention, intrusion detection, and regulatory compliance. In evaluation, we demonstrate that CamQuery reduces the latency of realtime query mechanisms, while imposing minimal overheads on system execution. CamQuery thus enables the further deployment of provenance-based technologies to address central challenges in computer security.Comment: 16 pages, 12 figures, 25th ACM Conference on Computer and Communications Security 201

  • Runtime Analysis of Whole-System Provenance
    HAL CCSD, 2018
    Co-Authors: Pasquier Thomas, Han Xueyuan, Moyer Thomas, Bates Adam, Hermant Olivier, Eyers David, Bacon Jean, Seltzer Margo
    Abstract:

    International audienceIdentifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of information within a computing system, connecting suspicious events to their root causes.Although existing provenance-based auditing techniques provide value in forensic analysis, they assume that such analysis takes place only retrospectively. Such post-hoc analysis is insufficient for realtime security applications; moreover, even for forensic tasks, prior provenance collection systems exhibited poor performance and scalability, jeopardizing the timeliness of query responses.We present CamQuery, which provides inline, realtime provenance analysis, making it suitable for implementing security applications. CamQuery is a Linux Security Module that offers support for both userspace and in-kernel execution of analysis applications. We demonstrate the applicability of CamQuery to a variety of runtime security applications including Data Loss Prevention, intrusion detection, and regulatory compliance. In evaluation, we demonstrate thatCamQuery reduces the latency of realtime query mechanisms, while imposing minimal overheads on system execution. CamQuery thus enables the further deployment of provenance-based technologies to address central challenges in computer security. Preprint: the final version of this paper will appear in the proceedings of the 25th ACM Conference on Computer and Communications Security in October 2018 (https://www.sigsac.org/ccs/CCS2018/)

  • Practical whole-system provenance capture
    'Association for Computing Machinery (ACM)', 2018
    Co-Authors: Pasquier Thomas, Moyer Thomas, Eyers David, Seltzer Margo, Han, Xueyuan Michael, Goldstein Mark, Bacon Jean
    Abstract:

    Data provenance describes how Data came to be in its present form. It includes Data sources and the transformations that have been applied to them. Data provenance has many uses, from forensics and security to aiding the reproducibility of scientific experiments. We present CamFlow, a whole-system provenance capture mechanism that integrates easily into a PaaS offering. While there have been several prior whole-system provenance systems that captured a comprehensive, systemic and ubiquitous record of a system’s behavior, none have been widely adopted. They either A) impose too much overhead, B) are designed for long-outdated kernel releases and are hard to port to current systems, C) generate too much Data, or D) are designed for a single system. CamFlow addresses these shortcoming by: 1) leveraging the latest kernel design advances to achieve efficiency; 2) using a self-contained, easily maintainable implementation relying on a Linux Security Module, NetFilter, and other existing kernel facilities; 3) providing a mechanism to tailor the captured provenance Data to the needs of the application; and 4) making it easy to integrate provenance across distributed systems. The provenance we capture is streamed and consumed by tenant-built auditor applications. We illustrate the usability of our implementation by describing three such applications: demonstrating compliance with Data regulations; performing fault/intrusion detection; and implementing Data Loss Prevention. We also show how CamFlow can be leveraged to capture meaningful provenance without modifying existing applications.Engineering and Applied Science

  • Practical Whole-System Provenance Capture
    'Association for Computing Machinery (ACM)', 2017
    Co-Authors: Pasquier Thomas, Han Xueyuan, Moyer Thomas, Eyers David, Seltzer Margo, Goldstein Mark, Bacon Jean
    Abstract:

    Data provenance describes how Data came to be in its present form. It includes Data sources and the transformations that have been applied to them. Data provenance has many uses, from forensics and security to aiding the reproducibility of scientific experiments. We present CamFlow, a whole-system provenance capture mechanism that integrates easily into a PaaS offering. While there have been several prior whole-system provenance systems that captured a comprehensive, systemic and ubiquitous record of a system's behavior, none have been widely adopted. They either A) impose too much overhead, B) are designed for long-outdated kernel releases and are hard to port to current systems, C) generate too much Data, or D) are designed for a single system. CamFlow addresses these shortcoming by: 1) leveraging the latest kernel design advances to achieve efficiency; 2) using a self-contained, easily maintainable implementation relying on a Linux Security Module, NetFilter, and other existing kernel facilities; 3) providing a mechanism to tailor the captured provenance Data to the needs of the application; and 4) making it easy to integrate provenance across distributed systems. The provenance we capture is streamed and consumed by tenant-built auditor applications. We illustrate the usability of our implementation by describing three such applications: demonstrating compliance with Data regulations; performing fault/intrusion detection; and implementing Data Loss Prevention. We also show how CamFlow can be leveraged to capture meaningful provenance without modifying existing applications.Comment: 15 pages, 7 figure

Adam Bates - One of the best experts on this subject based on the ideXlab platform.

  • runtime analysis of whole system provenance
    arXiv: Cryptography and Security, 2018
    Co-Authors: Thomas Pasquier, Xueyuan Han, Thomas Moyer, Adam Bates, Olivier Hermant, David Eyers, Jean Bacon, Margo Seltzer
    Abstract:

    Identifying the root cause and impact of a system intrusion remains a foundational challenge in computer security. Digital provenance provides a detailed history of the flow of information within a computing system, connecting suspicious events to their root causes. Although existing provenance-based auditing techniques provide value in forensic analysis, they assume that such analysis takes place only retrospectively. Such post-hoc analysis is insufficient for realtime security applications, moreover, even for forensic tasks, prior provenance collection systems exhibited poor performance and scalability, jeopardizing the timeliness of query responses. We present CamQuery, which provides inline, realtime provenance analysis, making it suitable for implementing security applications. CamQuery is a Linux Security Module that offers support for both userspace and in-kernel execution of analysis applications. We demonstrate the applicability of CamQuery to a variety of runtime security applications including Data Loss Prevention, intrusion detection, and regulatory compliance. In evaluation, we demonstrate that CamQuery reduces the latency of realtime query mechanisms, while imposing minimal overheads on system execution. CamQuery thus enables the further deployment of provenance-based technologies to address central challenges in computer security.

  • trustworthy whole system provenance for the linux kernel
    USENIX Security Symposium, 2015
    Co-Authors: Adam Bates, Dave Tian, Kevin R B Butler, Thomas Moyer
    Abstract:

    In a provenance-aware system, mechanisms gather and report metaData that describes the history of each object being processed on the system, allowing users to understand how Data objects came to exist in their present state. However, while past work has demonstrated the usefulness of provenance, less attention has been given to securing provenance-aware systems. Provenance itself is a ripe attack vector, and its authenticity and integrity must be guaranteed before it can be put to use. We present Linux Provenance Modules (LPM), the first general framework for the development of provenance-aware systems. We demonstrate that LPM creates a trusted provenance-aware execution environment, collecting complete whole-system provenance while imposing as little as 2.7% performance overhead on normal system operation. LPM introduces new mechanisms for secure provenance layering and authenticated communication between provenance-aware hosts, and also interoperates with existing mechanisms to provide strong security assurances. To demonstrate the potential uses of LPM, we design a Provenance-Based Data Loss Prevention (PB-DLP) system. We implement PBDLP as a file transfer application that blocks the transmission of files derived from sensitive ancestors while imposing just tens of milliseconds overhead. LPM is the first step towards widespread deployment of trustworthy provenance-aware applications.