Prototyping Flow-Net Logging for Accountability Management in Linux Operating Systems

Abstract

Accountability in conjunction with preventative countermeasures is necessary to satisfy the needs of real-world computer security. A common method to achieve accountability is via logging and auditing. To achieve better accountability, a logging system should be capable of capturing activities as well as the relationships among the activities in a computer system or network. Existing logging techniques record activity events in isolation and rely on attributes and time stamps of the logged events to establish their relationships, and this approach leads to probable loss of event relationships among large and complex logs and a confusion during auditing. Prior works have indicated that flow-net is effective in addressing this problem by organizing events in a direct acyclic graph and preserving event relationships during logging. In this work, we provide a prototypical design and implementation of a flow-net accountable logging framework in the Linux operating system. Particularly, it can be applied to Internet of Things (IoTs) with Android Operating Systems. We measure the performance overhead introduced by the flow-net logging prototype via experiments in Linux. The results indicate that the flow-net prototype only introduces a small overhead when compared with existing logging methods. In addition, we show by examples enforcement of accountability policies in the flow-net logging framework and its performance overhead. This work thus constitutes a further step to advance flow-net in addressing accountability in computer systems and networks.