Search papers, labs, and topics across Lattice.
This paper analyzes various kernel telemetry capture approaches for security-oriented provenance, identifying eBPF as the most effective method. Through micro benchmarks, the authors evaluate performance overhead and filtering mechanisms, particularly in containerized environments. The findings highlight that many existing provenance systems and capture agents lack the necessary integrity and availability for security applications, underscoring significant gaps in current methodologies.
Existing provenance systems often compromise on security, with many tools failing to ensure the integrity of captured events.
Provenance aims to capture the origins, transformations, and interactions of system objects for security and forensic applications. Existing provenance capture approaches still face major challenges and are not yet ready for production environments. In this paper, we first analyze the main kernel telemetry capture approaches, identifying eBPF as the most promising, and complement this analysis with micro benchmarks to assess its performance overhead and the filtering mechanisms used to achieve capture granularity, such as restricting capture to individual containers. Building on this foundation, we then classify, according to the studied capture approaches and filtering methods, eight provenance systems and five capture agents that could serve as their capture layers, collectively referred to as tools. Our study reveals that these tools are built on highly heterogeneous capture layers, most of which cannot guarantee the integrity and availability of the captured events, completely failing to meet the requirements of security-oriented use cases.
