TY - CONF
T1 - Take only what you need
T2 - 7th USENIX Workshop on the Theory and Practice of Provenance, TaPP 2015
AU - Bates, Adam
AU - Butler, Kevin R.B.
AU - Moyer, Thomas
N1 - Funding Information:
The Lincoln Laboratory portion of this work was sponsored by the Assistant Secretary of Defense for Research & Engineering under Air Force Contract #FA8721-05-C-0002. Opinions, interpretations, conclusions and recommendations are those of the author and are not necessarily endorsed by the United States Government.
Publisher Copyright:
Copyright © remains with the owner/author(s).
Copyright:
Copyright 2021 Elsevier B.V., All rights reserved.
PY - 2015
Y1 - 2015
N2 - When performing automatic provenance collection within the operating system, inevitable storage overheads are made worse by the fact that much of the generated lineage is uninteresting, describing noise and background activities that lie outside the scope the system's intended use. In this work, we propose a novel approach to policy-based provenance pruning - leverage the confinement properties provided by Mandatory Access Control (MAC) systems in order to identify subdomains of system activity for which to collect provenance. We consider the assurances of completeness that such a system could provide by sketching algorithms that reconcile provenance graphs with the information flows permitted by the MAC policy. We go on to identify the design challenges in implementing such a mechanism. In a simplified experiment, we demonstrate that adding a policy component to the Hi-Fi provenance monitor could reduce storage overhead by as much as 82%. To our knowledge, this is the first practical policy-based provenance monitor to be proposed in the literature.
AB - When performing automatic provenance collection within the operating system, inevitable storage overheads are made worse by the fact that much of the generated lineage is uninteresting, describing noise and background activities that lie outside the scope the system's intended use. In this work, we propose a novel approach to policy-based provenance pruning - leverage the confinement properties provided by Mandatory Access Control (MAC) systems in order to identify subdomains of system activity for which to collect provenance. We consider the assurances of completeness that such a system could provide by sketching algorithms that reconcile provenance graphs with the information flows permitted by the MAC policy. We go on to identify the design challenges in implementing such a mechanism. In a simplified experiment, we demonstrate that adding a policy component to the Hi-Fi provenance monitor could reduce storage overhead by as much as 82%. To our knowledge, this is the first practical policy-based provenance monitor to be proposed in the literature.
UR - http://www.scopus.com/inward/record.url?scp=84978118363&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84978118363&partnerID=8YFLogxK
M3 - Paper
AN - SCOPUS:84978118363
Y2 - 8 July 2015 through 9 July 2015
ER -