• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文学位 >Selective logging for accurate, space efficient forensic analysis and reducible execution replay.
【24h】

Selective logging for accurate, space efficient forensic analysis and reducible execution replay.

机译：选择性日志记录，用于准确，节省空间的取证分析和可简化的执行重播。

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Logging is a well-established technique to record dynamic information during system execution. It has two important capabilities: (1) investigating cyber attacks to identify the root cause of an attack, and to determine the ramification of an attack for recovery from it; and (2) reproducing software failures to understand and fix them. However, there are many long-running processes such as server programs and user interactive (UI) programs that receive a large volume of inputs and produce many outputs, where each output may be causally related to all the preceding inputs, making attack investigation almost infeasible. Another key challenge to applying a logging technique in attack investigation is the size of the logs. Audit logs generated by the traditional logging techniques can grow at a rate of gigabytes per day, incurring excessive storage and processing overhead. Logging and replaying long-running programs can be problematic because they may produce large replay logs that entail long replay time. The developer may have to wait for hours or days before a failure is reproduced.;In this dissertation, we present selective logging techniques for (1) highly accurate forensic analysis, (2) a space efficient audit logging system, and (3) reducible execution replay. We make three contributions. Our first contribution is a highly accurate attack provenance tracing technique enabled by a selective fine-grained logging method, called BEEP. It automatically partitions a long-running process into multiple autonomous units that handle independent input data. We show that BEEP effectively captures the minimal causal graph for every attack case we have studied. Our second contribution is a garbage collection enabled audit logging system, called LogGC. It automatically removes unreachable objects in audit logs that record history over a long period of time. With LogGC, space consumption of audit logs can be reduced by an order of magnitude without affecting the accuracy of forensic analysis. Our third contribution is a compiler-based technique that generates a reducible replay log. The technique divides an execution into units and instruments programs to collect minimal additional information into the replay log, and then reduction can be achieved through analyzing just the log.
机译：日志记录是一种成熟的技术，可以在系统执行期间记录动态信息。它具有两个重要功能：（1）调查网络攻击，以确定攻击的根本原因，并确定攻击的后果，以从中恢复。 （2）复制软件故障以理解和修复它们。但是，有许多长时间运行的进程，例如服务器程序和用户交互（UI）程序，它们会接收大量输入并产生许多输出，其中每个输出可能与前面的所有输入都有因果关系，因此几乎不可能进行攻击调查。在攻击调查中应用日志记录技术的另一个关键挑战是日志的大小。传统日志记录技术生成的审核日志每天可能以千兆字节的速度增长，从而导致过多的存储和处理开销。记录和重播长时间运行的程序可能会出现问题，因为它们可能会产生大量重播日志，从而需要较长的重播时间。在复制失败之前，开发人员可能需要等待数小时或数天。在本文中，我们提出了选择性的日志记录技术，用于（1）高精度的法证分析，（2）空间高效的审计日志系统和（3）可还原的执行重播。我们做出三点贡献。我们的第一个贡献是通过称为BEEP的选择性细粒度日志记录方法实现了高度精确的攻击源跟踪技术。它自动将长时间运行的进程划分为多个自治单元，以处理独立的输入数据。我们表明，对于我们研究的每个攻击案例，BEEP都能有效地捕获最小因果图。我们的第二个贡献是启用垃圾收集的审计日志系统，称为LogGC。它会自动删除审核日志中无法访问的对象，这些日志记录了很长一段时间。使用LogGC，审核日志的空间消耗可以减少一个数量级，而不会影响司法鉴定的准确性。我们的第三个贡献是基于编译器的技术，该技术可生成可简化的重播日志。该技术将执行划分为多个单元和工具程序，以将最少的其他信息收集到重播日志中，然后可以仅通过分析日志来实现减少。

著录项

  • 作者

    Lee, Kyu Hyung.;

  • 作者单位

    Purdue University.;

  • 授予单位 Purdue University.;
  • 学科 Computer science.
  • 学位 Ph.D.
  • 年度 2014
  • 页码 132 p.
  • 总页数 132
  • 原文格式 PDF
  • 正文语种 eng
  • 中图分类
  • 关键词

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号