A new tool for detecting tampering of big data programs

Abstract

We propose a tool called BigHASH for efficiently detecting tampering of big data programs (e.g., by malware) when executed in a private cluster or a public cloud environment. BigHASH produces the execution metadata of a program that precisely captures the critical internal data structures and content of the program (at runtime) using graph algorithms and homomorphic hashing. Homomorphic hashing provides two key benefits: (a) It enables parallel hash computation for efficiency. (b) It provides the ability to cope with cluster environments containing different number of servers when executing the program. BigHASH uses a blockchain network to store the execution metadata of programs as it provides a decentralized, secure, tamper-proof storage. To detect whether a program has been tampered or not during execution, BigHASH compares the execution metadata published by the owner (in a trusted environment) on the blockchain network to that produced by a user in his/her cluster environment. BigHASH is simple to use and provides automatic code instrumentation so that a programmer is not burdened to write any extra code to use BigHASH.