Simple generational garbage collection and fast allocation
Software—Practice & Experience
Garbage collection: algorithms for automatic dynamic memory management
Garbage collection: algorithms for automatic dynamic memory management
On-the-fly garbage collection: an exercise in cooperation
Communications of the ACM
An efficient, incremental, automatic garbage collector
Communications of the ACM
Performance and scalability of EJB applications
OOPSLA '02 Proceedings of the 17th ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications
Recovery from Malicious Transactions
IEEE Transactions on Knowledge and Data Engineering
SOSP '03 Proceedings of the nineteenth ACM symposium on Operating systems principles
Forensic Analysis of File System Intrusions Using Improved Backtracking
IWIA '05 Proceedings of the Third IEEE International Workshop on Information Assurance
Pin: building customized program analysis tools with dynamic instrumentation
Proceedings of the 2005 ACM SIGPLAN conference on Programming language design and implementation
The taser intrusion recovery system
Proceedings of the twentieth ACM symposium on Operating systems principles
Provenance-Aware Tracing ofWorm Break-in and Contaminations: A Process Coloring Approach
ICDCS '06 Proceedings of the 26th IEEE International Conference on Distributed Computing Systems
Trio: a system for data, uncertainty, and lineage
VLDB '06 Proceedings of the 32nd international conference on Very large data bases
Automatic high-performance reconstruction and recovery
Computer Networks: The International Journal of Computer and Telecommunications Networking
Understanding data lifetime via whole system simulation
SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Proceedings of the 2008 ACM SIGMOD international conference on Management of data
Trail of bytes: efficient support for forensic analysis
Proceedings of the 17th ACM conference on Computer and communications security
Intrusion recovery using selective re-execution
OSDI'10 Proceedings of the 9th USENIX conference on Operating systems design and implementation
Intrusion recovery for database-backed web applications
SOSP '11 Proceedings of the Twenty-Third ACM Symposium on Operating Systems Principles
Towards automated collection of application-level data provenance
TaPP'12 Proceedings of the 4th USENIX conference on Theory and Practice of Provenance
A hybrid approach for efficient provenance storage
Proceedings of the 21st ACM international conference on Information and knowledge management
SubZero: A fine-grained lineage system for scientific databases
ICDE '13 Proceedings of the 2013 IEEE International Conference on Data Engineering (ICDE 2013)
| Hi-index | 0.00 |
System-level audit logs capture the interactions between applications and the runtime environment. They are highly valuable for forensic analysis that aims to identify the root cause of an attack, which may occur long ago, or to determine the ramifications of an attack for recovery from it. A key challenge of audit log-based forensics in practice is the sheer size of the log files generated, which could grow at a rate of Gigabytes per day. In this paper, we propose LogGC, an audit logging system with garbage collection (GC) capability. We identify and overcome the unique challenges of garbage collection in the context of computer forensic analysis, which makes LogGC different from traditional memory GC techniques. We also develop techniques that instrument user applications at a small number of selected places to emit additional system events so that we can substantially reduce the false dependences between system events to improve GC effectiveness. Our results show that LogGC can reduce audit log size by 14 times for regular user systems and 37 times for server systems, without affecting the accuracy of forensic analysis.