Prototyping Flow-Net Logging for Accountability Management in Linux Operating Systems

Accountability in conjunction with preventative countermeasures is necessary to satisfy the needs of real-world computer security. A common method to achieve accountability is via logging and auditing. To achieve better accountability, a logging system should be capable of capturing activities as well as the relationships among the activities in a computer system or network. Existing logging techniques record activity events in isolation and rely on attributes and time stamps of the logged events to establish their relationships, and this approach leads to probable loss of event relationships among large and complex logs and a confusion during auditing. Prior works have indicated that flow-net is effective in addressing this problem by organizing events in a direct acyclic graph and preserving event relationships during logging. In this work, we provide a prototypical design and implementation of a flow-net accountable logging framework in the Linux operating system. Particularly, it can be applied to Internet of Things (IoTs) with Android Operating Systems. We measure the performance overhead introduced by the flow-net logging prototype via experiments in Linux. The results indicate that the flow-net prototype only introduces a small overhead when compared with existing logging methods. In addition, we show by examples enforcement of accountability policies in the flow-net logging framework and its performance overhead. This work thus constitutes a further step to advance flow-net in addressing accountability in computer systems and networks.

[1]  Mohammed G. H. al Zamil,et al.  A profile based data segmentation for in-home activity recognition , 2019, Int. J. Sens. Networks.

[2]  Bo Fu,et al.  Accountability and Q-Accountable Logging in Wireless Networks , 2014, Wireless Personal Communications.

[3]  Yang Xiao Flow-net methodology for accountability in wireless networks , 2009, IEEE Network.

[4]  Butler W. Lampson,et al.  31. Paper: Computer Security in the Real World Computer Security in the Real World , 2022 .

[5]  Crispin Cowan,et al.  Linux security modules: general security support for the linux kernel , 2002, Foundations of Intrusion Tolerant Systems, 2003 [Organically Assured and Survivable Information Systems].

[6]  Rainer Gerhards,et al.  The Syslog Protocol , 2009, RFC.

[7]  Rafael M. Gasca,et al.  Communicating between the kernel and user-space in Linux using Netlink sockets , 2010 .

[8]  Yang Xiao,et al.  Accountable administration in operating systems , 2017, Int. J. Inf. Comput. Secur..

[9]  Yang Xiao Accountability for wireless LANs, ad hoc networks, and wireless mesh networks , 2008, IEEE Communications Magazine.

[10]  Xu Wang,et al.  A traceable threshold attribute-based signcryption for mHealthcare social network , 2018, Int. J. Sens. Networks.

[11]  Elisa Bertino,et al.  The Design and Evaluation of Accountable Grid Computing System , 2009, 2009 29th IEEE International Conference on Distributed Computing Systems.

[12]  Bo Fu,et al.  FNF: Flow-net based fingerprinting and its applications , 2018, Comput. Secur..

[13]  Helen Nissenbaum,et al.  Computing and accountability , 1994, CACM.

[14]  J. K. Kalita,et al.  Botnet in DDoS Attacks: Trends and Challenges , 2015, IEEE Communications Surveys & Tutorials.

[15]  Jie Wu,et al.  P-Accountability: A Quantitative Study of Accountability in Networked Systems , 2017, Wirel. Pers. Commun..

[16]  Xiaodong Liu,et al.  Home appliances classification based on multi-feature using ELM , 2018, Int. J. Sens. Networks.

[17]  Arun Cyril Jose,et al.  Improving smart home security; integrating behaviour prediction into smart home , 2018, Int. J. Sens. Networks.

[18]  Leyla Bilge,et al.  Before we knew it: an empirical study of zero-day attacks in the real world , 2012, CCS.

[19]  P. Reiher,et al.  Building accountability into the future Internet , 2008, 2008 4th Workshop on Secure Network Protocols.

[20]  David P. Quigley,et al.  PLEASE: Policy Language for Easy Administration of SELinux , 2007 .

[21]  James A. Hendler,et al.  Information accountability , 2008, CACM.

[22]  Daniel J. Abadi,et al.  The FuzzyLog: A Partially Ordered Shared Log , 2018, OSDI.

[23]  Daisuke Takahashi,et al.  Accountability using flow-net: design, implementation, and performance evaluation , 2012, Secur. Commun. Networks.

[24]  Yang Xiao,et al.  A survey of accountability in computer networks and distributed systems , 2016, Secur. Commun. Networks.

[25]  Nick Feamster,et al.  Accountable internet protocol (aip) , 2008, SIGCOMM '08.

[26]  Bin Li,et al.  Detection of in-progress phone calls using smartphone proximity and orientation sensors , 2017, Int. J. Sens. Networks.

[27]  Somesh Jha,et al.  Kernel-Supported Cost-Effective Audit Logging for Causality Tracking , 2018, USENIX Annual Technical Conference.