Audit Log Collection And Management

2025

1. ACM CCS

   Rethinking Tamper-Evident Logging: A High-Performance, Co-Designed Auditing System

   Rui Zhao, Muhammad Shoaib, Viet Tung Hoang, and Wajih Ul Hassan

   In ACM Conference on Computer and Communications Security (CCS), 2025

   Abstract Bib PDF 🏅 Distinguished Paper Award

   Existing tamper-evident logging systems suffer from high overhead and severe data loss in high-load settings, yet only provide coarse-grained tamper detection. Moreover, installing such systems requires recompiling kernel code. To address these challenges, we present Nitro, a high-performance, tamper-evident audit logging system that supports fine-grained detection of log tampering. Even better, our system avoids kernel recompilation by using the eBPF technology. To formally justify the security of Nitro, we provide a new definitional framework for logging systems, and give a practical cryptographic construction meeting this new goal. Unlike prior work that focus only on the cryptographic processing, we codesign the cryptographic part with the pre- and post-processing of the logs to exploit all system-level optimizations. Our evaluations demonstrate Nitro’s superior performance, achieving 10X-25X improvements in high-stress conditions and 2X-10X in real-world scenarios while maintaining near-zero data loss. We also provide an advanced variant, Nitro-R that introduces in-kernel log reduction techniques to reduce runtime overhead even further.

   @inproceedings{nitro,
     title = {Rethinking Tamper-Evident Logging: A High-Performance, Co-Designed Auditing System},
     author = {Zhao, Rui and Shoaib, Muhammad and Hoang, Viet Tung and Hassan, Wajih Ul},
     booktitle = {ACM Conference on Computer and Communications Security (CCS)},
     year = {2025},
     doi = {10.1145/3719027.3765024}
   }

2023

1. Oakland

   SoK: History is a Vast Early Warning System: Auditing the Provenance of System Intrusions

   Muhammad Adil Inam, Yinfang Chen, Akul Goyal, Jason Liu, Jaron Mink, Noor Michael, Sneha Gaur, Adam Bates, and 1 more author

   In IEEE Symposium on Security and Privacy (S&P), 2023

   Abstract Bib PDF

   Auditing, a central pillar of operating system security, has only recently come into its own as an active area of public research. This resurgent interest is due in large part to the notion of data provenance, a technique that iteratively parses audit log entries into a dependency graph that explains the history of system execution. Provenance facilitates precise threat detection and investigation through causal analysis of sophisticated intrusion behaviors. However, the absence of a foundational audit literature, combined with the rapid publication of recent findings, makes it difficult to gain a holistic picture of advancements and open challenges in the area. In this work, we survey and categorize the provenance-based system auditing literature, distilling contributions into a layered taxonomy based on the audit log capture and analysis pipeline. Recognizing that the Reduction Layer remains a key obstacle to the further proliferation of causal analysis technologies, we delve further on this issue by conducting an ambitious independent evaluation of 8 exemplar reduction techniques against the recently-released DARPA Transparent Computing datasets. Our experiments uncover that past approaches frequently prune an overlapping set of activities from audit logs, reducing the synergistic benefits from applying them in tandem; further, we observe an inverse relation between storage efficiency and anomaly detection performance. However, we also observe that log reduction techniques are able to synergize effectively with data compression, potentially reducing log retention costs by multiple orders of magnitude. We conclude by discussing promising future directions for the field.

   @inproceedings{inam2022sok,
     title = {SoK: History is a Vast Early Warning System: Auditing the Provenance of System Intrusions},
     author = {Inam, Muhammad Adil and Chen, Yinfang and Goyal, Akul and Liu, Jason and Mink, Jaron and Michael, Noor and Gaur, Sneha and Bates, Adam and Hassan, Wajih Ul},
     booktitle = {IEEE Symposium on Security and Privacy (S\&P)},
     year = {2023},
     doi = {10.1109/sp46215.2023.10179405}
   }

2022

1. ACSAC

   FAuST: Striking a Bargain between Forensic Auditing’s Security and Throughput

   Muhammad Adil Inam, Akul Goyal, Jason Liu, Jaron Mink, Noor Michael, Sneha Gaur, Adam Bates, and Wajih Ul Hassan

   In Annual Computer Security Applications Conference (ACSAC), 2022

   Abstract Bib PDF

   System logs are invaluable to forensic audits, but grow so large that in practice fine-grained logs are quickly discarded - if captured at all - preventing the real-world use of the provenance-based investigation techniques that have gained popularity in the literature. Encouragingly, forensically-informed methods for reducing the size of system logs are a subject of frequent study. Unfortunately, many of these techniques are designed for offline reduction in a central server, meaning that the up-front cost of log capture, storage, and transmission must still be paid at the endpoints. Moreover, to date these techniques exist as isolated (and, often, closed-source) implementations; there does not exist a comprehensive framework through which the combined benefits of multiple log reduction techniques can be enjoyed. In this work, we present FAuST, an audit daemon for performing streaming audit log reduction at system endpoints. After registering with a log source (e.g., via Linux Audit’s audisp utility), FAuST incrementally builds an in-memory provenance graph of recent system activity. During graph construction, log reduction techniques that can be applied to local subgraphs are invoked immediately us-ing event callback handlers, while techniques meant for application on the global graph are invoked in periodic epochs. We evaluate FAuST, loaded with eight different log reduction modules from the literature, against the DARPA Transparent Computing datasets. Our experiments demonstrate the efficient performance of FAuST and identify certain subsets of reduction techniques that are synergistic with one another. Thus, FAuST dramatically simplifies the evaluation and deployment of log reduction techniques.

   @inproceedings{inam2022faust,
     title = {FAuST: Striking a Bargain between Forensic Auditing's Security and Throughput},
     author = {Inam, Muhammad Adil and Goyal, Akul and Liu, Jason and Mink, Jaron and Michael, Noor and Gaur, Sneha and Bates, Adam and Hassan, Wajih Ul},
     booktitle = {Annual Computer Security Applications Conference (ACSAC)},
     year = {2022},
     doi = {10.1145/3564625.3567990}
   }

2021

1. CCS

   Validating the Integrity of Audit Logs Against Execution Repartitioning Attacks

   Carter Yagemann, Mohammad Noureddine, Wajih Ul Hassan, Simon Chung, Adam Bates, and Wenke Lee

   In ACM Conference on Computer and Communications Security (CCS), 2021

   Abstract Bib PDF

   Provenance-based causal analysis of audit logs has proven to be an invaluable method of investigating system intrusions. However, it also suffers from dependency explosion, whereby long-running processes accumulate many dependencies that are hard to unravel. Execution unit partitioning addresses this by segmenting dependencies into units of work, such as isolating the events that processed a single HTTP request. Unfortunately, we discover that current designs have a semantic gap problem due to how system calls and application log messages are used to infer complex internal program states. We demonstrate how attackers can modify existing code exploits to control event partitioning, breaking links in the attack and framing innocent users. We also show how our techniques circumvent existing program and log integrity defenses.

   @inproceedings{yagemann2021validating,
     title = {Validating the Integrity of Audit Logs Against Execution Repartitioning Attacks},
     author = {Yagemann, Carter and Noureddine, Mohammad and Hassan, Wajih Ul and Chung, Simon and Bates, Adam and Lee, Wenke},
     year = {2021},
     booktitle = {ACM Conference on Computer and Communications Security (CCS)},
     doi = {10.1145/3460120.3484551}
   }

2020

1. ACSAC

   On the Forensic Validity of Approximated Audit Logs

   Noor Michael, Jaron Mink, Jason Liu, Sneha Gaur, Wajih Ul Hassan, and Adam Bates

   In Annual Computer Security Applications Conference (ACSAC), 2020

   Abstract Bib PDF

   Auditing is an increasingly essential tool for the defense of computing systems, but the unwieldy nature of log data imposes significant burdens on administrators and analysts. To address this issue, a variety of techniques have been proposed for approximating the contents of raw audit logs, facilitating efficient storage and analysis. However, the security value of these approximated logs is difficult to measure—relative to the original log, it is unclear if these techniques retain the forensic evidence needed to effectively investigate threats. Unfortunately, prior work has only investigated this issue anecdotally, demonstrating sufficient evidence is retained for specific attack scenarios.

   @inproceedings{approx,
     title = {On the Forensic Validity of Approximated Audit Logs},
     author = {Michael, Noor and Mink, Jaron and Liu, Jason and Gaur, Sneha and Hassan, Wajih Ul and Bates, Adam},
     year = {2020},
     booktitle = {Annual Computer Security Applications Conference (ACSAC)},
     doi = {10.1145/3427228.3427272}
   }

2. NDSS

   Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution

   Riccardo Paccagnella, Pubali Datta, Wajih Ul Hassan, Adam Bates, Christopher W. Fletcher, Andrew Miller, and Dave Tian

   In Symposium on Network and Distributed System Security (NDSS), 2020

   Abstract Bib PDF

   System auditing is a central concern when investigating and responding to security incidents. Unfortunately, attackers regularly engage in anti-forensic activities after a breakin, covering their tracks from the system logs in order to frustrate the efforts of investigators. While a variety of tamper-evident logging solutions have appeared throughout the industry and the literature, these techniques do not meet the operational and scalability requirements of system-layer audit frameworks. In this work, we introduce CUSTOS, a practical framework for the detection of tampering in system logs. CUSTOS consists of a tamper-evident logging layer and a decentralized auditing protocol. The former enables the verification of log integrity with minimal changes to the underlying logging framework, while the latter enables near real-time detection of log integrity violations within an enterprise-class network. CUSTOS is made practical by the observation that we can decouple the costs of cryptographic log commitments from the act of creating and storing log events, without trading off security, leveraging features of off-the-shelf trusted execution environments. Supporting over one million events per second, we show that CUSTOS’ tamper-evident logging protocol is three orders of magnitude (1000×) faster than prior solutions and incurs only between 2% and 7% runtime overhead over insecure logging on intensive workloads. Further, we show that CUSTOS’ auditing protocol can detect violations in near realtime even in the presence of a powerful distributed adversary and with minimal (3%) network overhead. Our case study on a real-world APT attack scenario demonstrates that CUSTOS forces anti-forensic attackers into a "lose-lose" situation, where they can either be covert and not tamper with logs (which can be used for forensics), or erase logs but then be detected by CUSTOS.

   @inproceedings{custos,
     title = {{Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution}},
     author = {Paccagnella, Riccardo and Datta, Pubali and Hassan, Wajih Ul and Bates, Adam and Fletcher, Christopher W. and Miller, Andrew and Tian, Dave},
     year = {2020},
     booktitle = {Symposium on Network and Distributed System Security (NDSS)},
     doi = {10.14722/ndss.2020.24065}
   }

2018

1. USENIX Security

   Analysis of privacy protections in fitness tracking social networks-or-you can run, but can you hide?

   Wajih Ul Hassan, Saad Hussain, and Adam Bates

   In USENIX Security Symposium, 2018

   Abstract Bib PDF

   Mobile fitness tracking apps allow users to track their workouts and share them with friends through online social networks. Although the sharing of personal data is an inherent risk in all social networks, the dangers presented by sharing personal workouts comprised of geospatial and health data may prove especially grave. While fitness apps offer a variety of privacy features, at present it is unclear if these countermeasures are sufficient to thwart a determined attacker, nor is it clear how many of these services’ users are at risk. In this work, we perform a systematic analysis of privacy behaviors and threats in fitness tracking social networks. Collecting a month-long snapshot of public posts of a popular fitness tracking service (21 million posts, 3 million users), we observe that 16.5% of users make use of Endpoint Privacy Zones (EPZs), which conceal fitness activity near user-designated sensitive lo-cations (e.g., home, office). We go on to develop an attack against EPZs that infers users’ protected locations from the remaining available information in public posts, discovering that 95.1% of moderately active users are at risk of having their protected locations extracted by an attacker. Finally, we consider the efficacy of state-of-the-art privacy mechanisms through adapting geo-indistinguishability techniques as well as developing a novel EPZ fuzzing technique. The affected companies have been notified of the discovered vulnerabilities and at the time of publication have incorporated our proposed countermeasures into their production systems.

   @inproceedings{hassan2018analysis,
     title = {Analysis of privacy protections in fitness tracking social networks-or-you can run, but can you hide?},
     author = {Hassan, Wajih Ul and Hussain, Saad and Bates, Adam},
     booktitle = {USENIX Security Symposium},
     pages = {497--512},
     year = {2018},
   }