Prototyping Flow-Net Logging for Accountability Management in Linux Operating Systems

Yang Xiao,Hui Chen,Lei Zeng,Tieshan Li

doi:10.1109/access.2019.2937637

Abstract

Accountability in conjunction with preventative countermeasures is necessary to satisfy the needs of real-world computer security. A common method to achieve accountability is via logging and auditing. To achieve better accountability, a logging system should be capable of capturing activities as well as the relationships among the activities in a computer system or network. Existing logging techniques record activity events in isolation and rely on attributes and time stamps of the logged events to establish their relationships, and this approach leads to probable loss of event relationships among large and complex logs and a confusion during auditing. Prior works have indicated that flow-net is effective in addressing this problem by organizing events in a direct acyclic graph and preserving event relationships during logging. In this work, we provide a prototypical design and implementation of a flow-net accountable logging framework in the Linux operating system. Particularly, it can be applied to Internet of Things (IoTs) with Android Operating Systems. We measure the performance overhead introduced by the flow-net logging prototype via experiments in Linux. The results indicate that the flow-net prototype only introduces a small overhead when compared with existing logging methods. In addition, we show by examples enforcement of accountability policies in the flow-net logging framework and its performance overhead. This work thus constitutes a further step to advance flow-net in addressing accountability in computer systems and networks.

Highlights

The common approach to ensure security is via preventative countermeasures, such as, access control and intrusion detection that attempt to prevent secure policy violations from security attacks [1]
This paper introduces a prototype of a flow-net logging framework to support accountability
We introduce a logging framework called flow-net to eliminate identified drawbacks incurred by the traditional logging techniques

Summary

Introduction

The common approach to ensure security is via preventative countermeasures, such as, access control and intrusion detection that attempt to prevent secure policy violations from security attacks [1]. Another approach is via accountability [1]–[8] — an after-the-fact examination of system activities to discern whether a violation of a security policy has occurred, and what has caused or what chain of events has led to the policy violation [1], [2], [9], [10]. A Linux system has logging services interacting with the Linux kernel These logging services maintain the user space logging buffers and consume logging messages in the user space buffers.

Objectives

Results

Conclusion