A systematic comparison of kernel telemetry capture for provenance finds eBPF LSM programs the most efficient, while most provenance systems lose 90-100% of logs and fail security requirements.
Smith, and Max Schuchard
1 Pith paper cite this work. Polarity classification is still indexing.
1
Pith paper citing it
citation-role summary
background 1
citation-polarity summary
fields
cs.CR 1years
2026 1verdicts
CONDITIONAL 1roles
background 1polarities
unclear 1representative citing papers
citing papers explorer
-
A Study of Kernel Telemetry Options for Security-Oriented Provenance
A systematic comparison of kernel telemetry capture for provenance finds eBPF LSM programs the most efficient, while most provenance systems lose 90-100% of logs and fail security requirements.