Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces vCause, a system for verifiable causality analysis in cloud-based endpoint auditing that addresses the risk of compromised cloud environments manipulating analysis results. vCause employs a graph accumulator and verifiable provenance graph to enable validation of point-of-interest node queries and identification of causally related components. Security analysis and experimental results demonstrate that vCause achieves secure and verifiable causality analysis with minimal overhead on both endpoints and the cloud.
Worried about compromised cloud environments skewing your endpoint auditing? vCause offers a verifiable causality analysis system with negligible overhead.
In cloud-based endpoint auditing, security administrators often rely on the cloud to perform causality analysis over log-derived versioned provenance graphs to investigate suspicious attack behaviors. However, the cloud may be distrusted or compromised by attackers, potentially manipulating the final causality analysis results. Consequently, administrators may not accurately understand attack behaviors and fail to implement effective countermeasures. This risk underscores the need for a defense scheme to ensure the integrity of causality analysis. While existing tamper-evident logging schemes and trusted execution environments show promise for this task, they are not specifically designed to support causality analysis and thus face inherent security and efficiency limitations. This paper presents vCause, an efficient and verifiable causality analysis system for cloud-based endpoint auditing. vCause integrates two authenticated data structures: a graph accumulator and a verifiable provenance graph. The data structures enable validation of two critical steps in causality analysis: (i) querying a point-of-interest node on a versioned provenance graph, and (ii) identifying its causally related components. Formal security analysis and experimental evaluation show that vCause can achieve secure and verifiable causality analysis with only<1% computational overhead on endpoints and 3.36% on the cloud.