Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

vCause: Efficient and Verifiable Causality Analysis for Cloud-based Endpoint Auditing

Qiyang Song, Qihang Zhou, Xiaoqi Jia, Zhenyu Song, Wenbo Jiang, Heqing Huang, Yong Liu, Dan Meng

Abstract

In cloud-based endpoint auditing, security administrators often rely on the cloud to perform causality analysis over log-derived versioned provenance graphs to investigate suspicious attack behaviors. However, the cloud may be distrusted or compromised by attackers, potentially manipulating the final causality analysis results. Consequently, administrators may not accurately understand attack behaviors and fail to implement effective countermeasures. This risk underscores the need for a defense scheme to ensure the integrity of causality analysis. While existing tamper-evident logging schemes and trusted execution environments show promise for this task, they are not specifically designed to support causality analysis and thus face inherent security and efficiency limitations. This paper presents vCause, an efficient and verifiable causality analysis system for cloud-based endpoint auditing. vCause integrates two authenticated data structures: a graph accumulator and a verifiable provenance graph. The data structures enable validation of two critical steps in causality analysis: (i) querying a point-of-interest node on a versioned provenance graph, and (ii) identifying its causally related components. Formal security analysis and experimental evaluation show that vCause can achieve secure and verifiable causality analysis with only <1% computational overhead on endpoints and 3.36% on the cloud.

vCause: Efficient and Verifiable Causality Analysis for Cloud-based Endpoint Auditing

Abstract

In cloud-based endpoint auditing, security administrators often rely on the cloud to perform causality analysis over log-derived versioned provenance graphs to investigate suspicious attack behaviors. However, the cloud may be distrusted or compromised by attackers, potentially manipulating the final causality analysis results. Consequently, administrators may not accurately understand attack behaviors and fail to implement effective countermeasures. This risk underscores the need for a defense scheme to ensure the integrity of causality analysis. While existing tamper-evident logging schemes and trusted execution environments show promise for this task, they are not specifically designed to support causality analysis and thus face inherent security and efficiency limitations. This paper presents vCause, an efficient and verifiable causality analysis system for cloud-based endpoint auditing. vCause integrates two authenticated data structures: a graph accumulator and a verifiable provenance graph. The data structures enable validation of two critical steps in causality analysis: (i) querying a point-of-interest node on a versioned provenance graph, and (ii) identifying its causally related components. Formal security analysis and experimental evaluation show that vCause can achieve secure and verifiable causality analysis with only <1% computational overhead on endpoints and 3.36% on the cloud.
Paper Structure (37 sections, 2 theorems, 14 equations, 16 figures, 5 tables, 5 algorithms)

This paper contains 37 sections, 2 theorems, 14 equations, 16 figures, 5 tables, 5 algorithms.

Table of Contents

  1. Introduction
  2. Background and Related Work
  3. Causality Analysis on Provenance Graphs
  4. Related Integrity Validation Approaches
  5. System Overview
  6. Threat Model
  7. Problem Formulation
  8. System Model and Workflow
  9. Graph Accumulator
  10. Hierarchical Tree Accumulation Structure
  11. Single-Node Proof and Validation
  12. Dynamic Indexed Merkle Tree
  13. Verifiable Versioned Provenance Graph
  14. Incoming Path Digests
  15. Backward Causality Relation Validation
  16. ...and 22 more sections

Key Result

Theorem 1

vCause achieves unforgeability of causality analysis results if the signature scheme is EUF-CMA-secure dodis2012message, the Merkle tree structure is position-binding catalano2013vector, and the verifiable versioned provenance graph upholds causality relation unforgeability (Appendix ap:graph_securi

Figures (16)

  • Figure 1: A versioned provenance graph
  • Figure 2: Architecture of vCause
  • Figure 3: Graph accumulator. Here, $H(\cdot)$ is a hash function.
  • Figure 4: Single-node membership proof
  • Figure 5: Structure of DIM-Tree. Node insertion triggers a merge with the last subtree, forming a larger subtree of size $2$.
  • ...and 11 more figures

Theorems & Definitions (5)

  • Definition 1: Causality Analysis
  • Definition 2
  • Theorem 1
  • Definition 3: Causality Relation Unforgeability
  • Theorem 2