Universal Provenance Graph for Layered Software Event Stream Integration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current system auditing technologies face challenges in detecting and investigating complex attacks, such as Advanced Persistent Threats, due to the lack of incorporation of application-layer semantics and the semantic gap between system and application logging contexts, leading to difficulties in tracing attack dependencies and reconstructing multi-application workflows.
Innovation Solution
A mechanism for creating a Universal Provenance Graph (UPG) that transparently combines causal dependencies from various application event logs across layered software systems, using a provenance-tracking mechanism to bridge the semantic gap and encode forensically relevant causal dependencies, allowing for precise reasoning about attacks without requiring instrumentation or developer intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If system auditing technologies use traditional system audit logs without application-layer semantics, then the system complexity remains low, but the ability to detect and trace complex attacks deteriorates
Solution Approach 1:
The patent segments the provenance tracking into two distinct layers: system-layer provenance tracking using audit logs, and application-layer provenance tracking using structured event logs. This segmentation allows each layer to be optimized independently, reducing overall complexity while maintaining comprehensive attack detection capability.
Solution Approach 2:
The patent introduces an intermediary mechanism that translates application events into a standardized provenance format that can be integrated with system-layer provenance data. This intermediary layer bridges the semantic gap between system and application logging contexts without requiring complex direct integration.
2Measurement precision
If system auditing incorporates application event logs with semantic information, then the precision of attack tracing improves, but the difficulty of integrating heterogeneous logging contexts worsens
Solution Approach 1:
The patent creates a universal provenance format that can represent both system-layer and application-layer events. This universal format serves multiple functions: it preserves semantic information from application logs, maintains compatibility with system audit logs, and provides a common interface for provenance analysis across heterogeneous logging contexts.
Solution Approach 2:
The patent transforms application event logs by extracting and standardizing key parameters such as event type, source, target, and causal relationships. This parameter transformation converts heterogeneous application-specific log formats into a standardized provenance representation that can be seamlessly integrated with system-layer provenance data.
3Productivity
If traditional provenance graphs are used without execution partitioning, then the implementation remains simple, but the dependency explosion problem worsens
Solution Approach 1:
The patent performs preliminary execution partitioning by identifying execution units and their boundaries before constructing the provenance graph. This preliminary action divides the continuous execution trace into discrete, manageable units, preventing dependency explosion while preserving the necessary causal relationships for accurate attack tracing.
Solution Approach 2:
The patent extracts only the forensically relevant causal dependencies from the full execution trace, separating essential provenance information from unnecessary details. This extraction process reduces the volume of provenance data while maintaining the precision needed for attack detection and analysis.
Data Source
AI summary
A computerized method includes analyzing program code, including a control flow graph, of one or more applications that are executable by an operating system of a computing device to determine event-logging functions of the program code that generate event logs; extracting, by the processing device based on the event-logging functions, log message strings from the program code that describes event-logging statements; identifying, by the processing device, via control flow analysis, possible control flow paths of the log message strings through the control flow graph; storing, in a database accessible by the processing device, the possible control flow paths; and inputting, by the processing device into a log parser, the possible control flow paths of the log message strings to facilitate interpretation of application events during runtime execution of the one or more applications.