Pith. sign in

REVIEW 3 major objections 4 minor 50 references

A Study of Kernel Telemetry Options for Security-Oriented Provenance

T0 review · 3 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Security provenance tools drop 90-100% of kernel events

desk verdict First systematic capture-layer comparison for provenance, genuinely useful, but the LSM single-attachment edge conflates authorization with operation success; quantitative claims need error bars, artifacts, and rework before they stand. read the letter →

arxiv 2608.11418 v1 pith:EFFDZUZR submitted 2026-08-11 cs.CR

Paul R. B. Houssel , Olivier Levillain , Sylvie Laniepce , Nicolas Dejon , Hervé Debar This is my paper · ORCID
classification cs.CR
keywords provenancekerneltelemetryeBPFLSMcgroupfilteringTOCTOUcontainersecurityLinuxaudit
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to determine which Linux kernel telemetry mechanism should carry security-oriented provenance capture, and it argues that eBPF programs attached to Linux Security Module (LSM) hooks are the best choice. Benchmarks across network, file, and process workloads show that LSM programs record both an operation's arguments and its verdict with a single attachment, while tracepoint, kprobe, and tracing programs must instrument entry and exit and roughly double their per-event cost. Adding cgroup attachment lets LSM programs pre-filter events so they only run for the traced container, the cheapest of the three filtering methods. The paper then classifies eight provenance systems and five capture agents, and macro-benchmarks the open-source subset: most graph-building systems lose 90 to 100 percent of expected events, and no system combines low overhead, no log loss, and actual graph construction. If correct, current provenance systems are not ready for security use, and future capture layers should be built on LSM-based eBPF with cgroup pre-filtering.

What carries the argument

The central object is the eBPF LSM program attached to a Linux Security Module interface (the LSM_MAC attach type, optionally restricted to a cgroup via LSM_CGROUP), dispatched through a BPF trampoline. Because it sits at the end of the LSM chain, it fires only after every other LSM has allowed the operation, so one hook instance carries both the arguments and the verdict at a single attachment. The same mechanism's cgroup flavor enables pre-filtering, in which the kernel skips the program entirely for events outside the traced container, avoiding the per-event cost of in-program or user-space filtering. The comparison machinery is the micro-benchmark that separates entry attachment cost from exit attachment cost, making visible the roughly doubled per-event overhead that non-LSM program types incur once the verdict is captured.

What would settle it

Run the benchmark file-creation workload on a filesystem configured to fail with ENOSPC after the inode security initialization hook, then compare the count of recorded LSM events against the actual number of files created; a surplus of recorded events over created files would show that single-attachment capture records attempted operations as if they succeeded.

Watch

Extended reading notes

Core claim

Using the ability to record a MAC operation's arguments together with its final verdict in a single LSM hook firing as the key efficiency test, the paper shows that LSM eBPF programs beat tracepoint, kprobe, and tracing programs on every workload once verdict capture is required. It also shows that cgroup-attached LSM programs, which the kernel only triggers for events in the target cgroup, outperform in-program and post-hoc filtering across all workloads. Measured against the set of benchmarked open-source tools, the paper finds that the systems that build provenance graphs all suffer roughly 90-100 percent log loss in most workloads, while the one system that avoids loss emits a raw edge stream and never constructs a graph. The paper concludes that provenance systems currently rely on capture layers that cannot guarantee event integrity and availability, and that LSM interfaces, which expose kernel-object life cycles over a smaller hook surface than system calls, are the most suitable basis for security-oriented provenance capture.

Load-bearing premise

The load-bearing assumption is that an LSM hook firing after all other LSMs have allowed an operation counts as that operation having actually succeeded; in reality the kernel operation can still fail later, so some recorded events may not correspond to real events.

Editorial extensions

If this is right

  • LSM eBPF programs with cgroup attachment should form the capture basis for new provenance systems, because they are the only measured configuration that combines single-attachment verdict capture, stable interfaces, and pre-filtering overhead.
  • Every non-LSM eBPF program type must hook both entry and exit to discard denied operations, roughly doubling per-event cost; any system-call trace that omits exit events records attempts as if they were successes.
  • Because all benchmarked graph-building systems lose 90 to 100 percent of expected events in most workloads, their provenance graphs are heavily incomplete, so security analyses built on them inherit that incompleteness.
  • The one lossless system's raw edge stream avoids graph construction entirely, showing that low overhead and completeness are achievable together only when graph modeling is abandoned; reconciling them remains unsolved.
  • The maintained, portable capture agents are better building blocks for future provenance capture than the unmaintained research systems, despite their own overhead and log loss.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • We infer that LSM-only capture, if the completeness gaps found for older kernels persist, would miss information flows through pipes, splice, and shared memory; comparing an LSM-hook trace against a system-call trace on one workload would decide this.
  • We infer that the cgroup pre-filtering advantage generalizes to other granularities such as pods, processes, or users, since the same BPF link mechanism can attach to different cgroup or namespace scopes; the paper only measures containers.
  • We infer that the single-attachment verdict claim can be stress-tested by injecting late kernel failures after the LSM hook; if recorded events exceed actual completions, the claimed equivalence between hook firing and operation success would be weakened.
  • We infer that combining the low-loss edge-stream design with LSM capture could produce a graph-building system that is both efficient and complete; the paper does not benchmark this combination, so it remains an open testable direction.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper studies Linux kernel telemetry capture for security-oriented provenance. It classifies capture approaches (ptrace, filesystem snapshots, integrated systems, out-of-tree modules, eBPF), benchmarks four eBPF program types (tracepoint, kprobe, tracing, LSM) and three filtering granularities (pre/in/post) under three workloads, and classifies eight provenance systems and five capture agents, macro-benchmarking the open-source subset. The paper concludes that eBPF LSM programs are the best capture basis, citing single-attachment capture of arguments and verdict, cgroup prefiltering, stable interfaces, and TOCTOU resistance, and that most provenance systems suffer 90-100% event loss, making them unsuitable for security use cases.

Significance. If the results hold, this is a useful comparative study: it systematizes capture-layer options, gives a reproducible microbenchmark harness across eBPF program types and filtering strategies, and quantifies event loss of real provenance systems. The TOCTOU analysis in Section 3.3 is a valuable contribution, and the classification tables in Section 5.3 are a practical reference for system builders. However, the central comparison rests on an interpretation of LSM single-attachment semantics that needs correction, and key measurements lack uncertainty quantification. With those points addressed, the paper would be a solid reference for kernel-telemetry provenance research.

major comments (3)
  1. [Section 4.2, Table 4] The central efficiency claim that LSM programs obtain 'arguments and verdict with a single attachment' equates passing the LSM chain with the operation's final success. An LSM hook fires during the security-check path, before the protected operation commits. For the benchmarked hooks this is concrete: inode_init_security runs during inode creation but the file creation can still fail afterwards (e.g., ENOSPC during block allocation); socket_accept can be followed by failure to allocate a file descriptor (EMFILE); task_alloc can be followed by memory-allocation failure in copy_process. The paper's own provenance criterion in the same section states that 'a provenance graph must contain only the causal events that actually occurred.' An LSM-only record is an authorization event, not a completion event, so the Figure 1 comparison is not apples-to-apples: dual-attachment tracepoint/kprobe/tracing instrumentation discards rejected or failed operations, while the LSM program records them. The claimed single-attachment advantage is therefore partly an artifact of capturing weaker semantics. The authors should either demonstrate that post-hook failures are negligible for the chosen hooks (with failure-injection or error-path measurements), or reframe the LSM capture as authorization-event provenance, or instrument exits via kprobes for a fair comparison.
  2. [Section 4.1, Section 4.2, Figure 1] The microbenchmark's central quantitative claims are made without uncertainty estimates. Section 4.1 says values are 'averaged over 10 runs after 10 warm-up iterations,' and Figure 1 reports overheads that differ by less than 0.1 percentage points in the key comparison (LSM 1.13% vs. tracing 1.22% for the network workload at the LSM location after verdict capture). The text says the entry-only gap between LSM and tracing is 'negligible given the variance,' but no variance, confidence interval, or per-run distribution is reported. Without such information, the conclusion that LSM programs are 'the most efficient for provenance capture' is not statistically supported, and the conclusion that LSM is cheaper than tracing after verdict capture rests on a 0.09-point gap. Please report per-run values or confidence intervals, state whether the differences are statistically significant, and adjust the claims accordingly.
  3. [Section 5.1, Figure 3] The macro benchmark's log-loss metric is computed as (1 - n_traced / n_expected) x 100 for a single witness event per workload (e.g., 50k clone events for the process workload), while each tool runs on a separate Fedora 35 VM 'keeping each system's defaults.' This conflates a tool's intentional capture scope (ConProv instruments only 9 interfaces; eAudit emits a raw stream without graph reconstruction) with failure to meet the workload's ground truth. To support the strong claim that 'most unable to guarantee event integrity and availability,' the authors should either configure each system to a common, security-relevant minimum event set justified against the witness events, or demonstrate that the witness events are mandatory for the stated security use cases, and should quantify VM-to-VM variability. The current '90 to 100% loss' statement is therefore not yet fully supported as a claim about capture-layer failure.
minor comments (4)
  1. [Abstract] In the abstract, 'thesetoolsare built' is missing a space between 'these' and 'tools'; please fix the LaTeX spacing.
  2. [Figure 1] Figure 1's x-axis annotations ('100k 200k ...') are difficult to read and the caption does not clearly explain the mapping of those counts to eBPF program executions per workload; please clarify.
  3. [Figure 3 and Table 5] The name 'SPADE' in Figure 3 is written as 'Spade' in Table 5 and the text; please unify the capitalization.
  4. [Section 4.3] The terms 'prefiltering', 'pre filtering', and 'pre' are used inconsistently; please standardize the terminology.

Circularity Check

0 steps flagged · score 2.0 of 10

No material circularity; measured benchmarks are self-contained, with one minor non-load-bearing self-citation.

full rationale

The paper contains no fitted-parameter or predicted-quantity derivation chain that reduces to its inputs. The central quantitative results are direct measurements: relative CPU overhead against an untraced baseline (Section 4.2), filtering overhead under duplicate-container workloads (Section 4.3), and macro-benchmark log loss computed as (1 - n_traced/n_expected) against known ground-truth event counts (Section 5.1). None of these quantities is produced by a model whose parameters were fitted to the reported outcomes. The only same-author citation is [19], used for qualitative ABI-stability and portability ratings of ptrace, kernel modules, and eBPF/LSM interfaces; this self-citation is not load-bearing for the measured overhead or loss figures, is consistent with independent citations [47] and kernel-version facts, and does not by itself force the paper's conclusion. A separate, non-circular validity caveat exists in Section 4.2: treating LSM-chain allowance as the operation verdict may overstate the single-attachment efficiency advantage, since kernel failures after an LSM hook (e.g., ENOSPC after inode_init_security) are not captured; this weakens the semantic-equivalence assumption but is not a circular reduction. Accordingly, no circular step is identified and the score reflects only the minor, non-load-bearing self-citation.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

No free parameters or invented entities appear; the paper's claims rest on benchmark measurements and the modeling assumptions listed above.

assumptions (5)
  • ad hoc to paper An LSM hook firing with all prior LSMs allowing is treated as the operation verdict for provenance.
    Section 4.2: LSM programs registered last in the chain are said to obtain arguments and verdict with a single attachment; this equates the LSM security decision with the final success of the kernel operation, which can still fail later (e.g., ENOSPC).
  • domain assumption The three benchmark workloads are representative of production workloads for provenance overhead.
    Section 4.1 uses httperf, postmark, and shbm for network, file, and process workloads; generalization to production is assumed.
  • domain assumption Witness events (e.g., 50k clone events) give the ground-truth count for log loss.
    Section 5.1 defines log loss as (1 - n_traced/n_expected) over a per-workload witness event; this presumes the expected count is exactly known and that a single witness measures overall availability.
  • domain assumption The eBPF programs compared are semantically equivalent.
    Section 4.1: 'All programs share the same eBPF maps, layouts, and user-space logger... ensuring semantic equivalence.'
  • domain assumption TOCTOU exposure of system call hooking can be inferred from user-space pointer argument counts.
    Section 3.3 infers TOCTOU vulnerability from the count of system calls with user-space pointers; this assumes every such pointer can be raced in practice.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Study of Kernel Telemetry Options for Security-Oriented Provenance." pith.science (2026). https://pith.science/paper/EFFDZUZR

@misc{pith2026260811418,
  author       = {Pith},
  title        = {Pith review of: A Study of Kernel Telemetry Options for Security-Oriented Provenance},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EFFDZUZR}},
  note         = {Machine review of arXiv:2608.11418}
}
read the original abstract

Provenance aims to capture the origins, transformations, and interactions of system objects for security and forensic applications. Existing provenance capture approaches still face major challenges and are not yet ready for production environments. In this paper, we first analyze the main kernel telemetry capture approaches, identifying eBPF as the most promising, and complement this analysis with micro benchmarks to assess its performance overhead and the filtering mechanisms used to achieve capture granularity, such as restricting capture to individual containers. Building on this foundation, we then classify, according to the studied capture approaches and filtering methods, eight provenance systems and five capture agents that could serve as their capture layers, collectively referred to as tools. Our study reveals that these tools are built on highly heterogeneous capture layers, most of which cannot guarantee the integrity and availability of the captured events, completely failing to meet the requirements of security-oriented use cases.

Figures

Figures reproduced from arXiv: 2608.11418 by the authors.

Figure 1
Figure 1. Performance overhead among eBPF programs. [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Performance overhead as a function of the filtering used to achieve container granu [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Macro benchmark of open-source provenance systems [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Macro benchmark of open-source capture agents. 18 [PITH_FULL_IMAGE:figures/full_fig_p018_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 50 canonical work pages

  1. [1]

    FirmSolo: enabling dy- namic analysis of binary Linux-based IoT kernel modules

    Ioannis Angelakopoulos, Gianluca Stringhini, and Manuel Egele. FirmSolo: enabling dy- namic analysis of binary Linux-based IoT kernel modules. InProceedings of the 32nd 13 USENIX Conference on Security Symposium, SEC ’23, pages 5021–5038. USENIX, 2023. ISBN 978-1-939133-37-3

    work page 2023

  2. [2]

    auditd - The Linux Audit daemon, 2004

    auditd. auditd - The Linux Audit daemon, 2004

    work page 2004

  3. [3]

    Automated Synthesis of Effect Graph Policies for Microservice-Aware Stateful System Call Specialization

    William Blair, Frederico Araujo, Teryl Taylor, and Jiyong Jang. Automated Synthesis of Effect Graph Policies for Microservice-Aware Stateful System Call Specialization. In2024 IEEE Symposium on Security and Privacy (SP), pages 4554–4572. IEEE, May 2024

    work page 2024

  4. [4]

    A primer on provenance.Communications of the ACM, May 2014

    LucianCarata, SherifAkoush, NikileshBalakrishnan, ThomasBytheway, RipdumanSohan, Margo Seltzer, and Andy Hopper. A primer on provenance.Communications of the ACM, May 2014

    work page 2014

  5. [5]

    CLARION: Sound and Clear Provenance Tracking for Mi- croservice Deployments

    Xutong Chen and Yan Chen. CLARION: Sound and Clear Provenance Tracking for Mi- croservice Deployments. InProceedings of the 30th USENIX Security Symposium (SEC), pages 3989–4006. USENIX Association, 2021

    work page 2021

  6. [6]

    Smith, and Max Schuchard

    Emma Connor, Tyler McDaniel, Jared M. Smith, and Max Schuchard. PKU Pitfalls: Attacks on PKU-based Memory Isolation Systems. InProceedings of the 29th USENIX Security Symposium (SEC), pages 1409–1426. ACM, 2020. ISBN 978-1-939133-17-5

    work page 2020

  7. [7]

    Pairwise bpf programs should be optimized together

    Milo Craun and Dan Williams. Pairwise bpf programs should be optimized together. In Proceedings of the 3rd Workshop on eBPF and Kernel Extensions, 2025

    work page 2025

  8. [8]

    Eliminating eBPF Tracing Overhead on Untraced Processes

    Milo Craun, Khizar Hussain, Uddhav Gautam, Zhengjie Ji, Tanuj Rao, and Dan Williams. Eliminating eBPF Tracing Overhead on Untraced Processes. InProceedings of the SIG- COMM Workshop on eBPF and Kernel Extensions, pages 16–22. ACM, August 2024. ISBN 979-8-4007-0712-4

    work page 2024

Show all 50 references
  1. [9]

    ALASTOR: Reconstructing the Provenance of Serverless Intrusions

    Pubali Datta, Isaac Polinsky, Muhammad Adil Inam, Adam Bates, and William Enck. ALASTOR: Reconstructing the Provenance of Serverless Intrusions. InProceedings of the 31st USENIX Security Symposium (SEC), pages 2443–2460. ACM, 2022

    2022

  2. [10]

    ConProv: AContainer- Aware Provenance System for Attack Investigation

    QiqingDeng, YanqiangZhang, ZhenXu, QianTan, andYanZhang. ConProv: AContainer- Aware Provenance System for Attack Investigation. InAnnual Computer Security Applica- tions Conference (ACSAC) 2025 Proceedings, pages 89–101. IEEE, 2024

    2025

  3. [11]

    Are we there yet? An Industrial Viewpoint on Provenance-based Endpoint Detection and Response Tools

    Feng Dong, Shaofei Li, Peng Jiang, Ding Li, Haoyu Wang, Liangyi Huang, Xusheng Xiao, Jiedong Chen, Xiapu Luo, Yao Guo, and Xiangqun Chen. Are we there yet? An Industrial Viewpoint on Provenance-based Endpoint Detection and Response Tools. InProceedings of the 2023 ACM SIGSAC C...

    2023

  4. [12]

    Falco: open source security tool for containers, kubernetes and cloud, 2014

    Falco. Falco: open source security tool for containers, kubernetes and cloud, 2014

    2014

  5. [13]

    bpf: per-cgroup lsm flavor

    Stanislav Fomichev. bpf: per-cgroup lsm flavor. https://github.com/torvalds/linux/ commit/69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e, 2022. Git commit 69fd337

    2022

  6. [14]

    Spade: Support for provenance auditing in distributed environments

    Ashish Gehani and Dawood Tariq. Spade: Support for provenance auditing in distributed environments. InACM/IFIP/USENIX International Conference on Distributed Systems Platforms and Open Distributed Processing, pages 101–120. Springer, 2012

    2012

  7. [15]

    Kayrebt: An activity dia- gramextractionandvisualizationtoolsetdesignedfortheLinuxcodebase

    Laurent Georget, Frederic Tronel, and Valerie Viet Triem Tong. Kayrebt: An activity dia- gramextractionandvisualizationtoolsetdesignedfortheLinuxcodebase. In2015 IEEE 3rd Working Conference on Software Visualization (VISSOFT), pages 170–174. IEEE, Septem- ber 2015. ISBN 978-1-...

    2015

  8. [16]

    Verifying the Reliability of Operating System-Level Information Flow Control Sys- tems in Linux

    LaurentGeorget, MathieuJaume, FredericTronel, GuillaumePiolle, andValerieVietTriem Tong. Verifying the Reliability of Operating System-Level Information Flow Control Sys- tems in Linux. In2017 IEEE/ACM 5th International FME Workshop on Formal Methods in Software Engineering (F...

    2017

  9. [17]

    Trace Me If You can: BypassingLinux Syscall Tracing, 2022

    Rex Guo and Junyuan Zeng. Trace Me If You can: BypassingLinux Syscall Tracing, 2022. DEF CON 30

    2022

  10. [18]

    Towards Scalable Cluster Auditing through Grammatical Inference over Provenance Graphs

    Wajih Ul Hassan, Mark Lemay, Nuraini Aguse, Adam Bates, and Thomas Moyer. Towards Scalable Cluster Auditing through Grammatical Inference over Provenance Graphs. In Proceedings 2018 Network and Distributed System Security Symposium (NDSS), pages 840–

    2018

  11. [19]

    Paul R. B. Houssel, Sylvie Laniepce, and Olivier Levillain. Towards Provenance for Cy- bersecurity in Cloud-Native Production Infrastructure. In2025 55th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, volume Supplemental Vol- ume (DSN-S) ofDSN 20...

    2025

  12. [20]

    SoK: History is a Vast Early Warning System: Auditing the Provenance of System Intrusions

    Muhammad Adil Inam, Yinfang Chen, Akul Goyal, Jason Liu, Jaron Mink, Noor Michael, Sneha Gaur, Adam Bates, and Wajih Ul Hassan. SoK: History is a Vast Early Warning System: Auditing the Provenance of System Intrusions. In2023 IEEE Symposium on Security and Privacy (SP), pages ...

    2023

  13. [21]

    TRACE: Enterprise-Wide Provenance Tracking for Real-Time APT Detection.IEEE Transactions on Information Forensics and Security, 16:4363–4376, 2021

    Hassaan Irshad, Gabriela Ciocarlie, Ashish Gehani, Vinod Yegneswaran, Kyu Hyung Lee, Jignesh Patel, Somesh Jha, Yonghwi Kwon, Dongyan Xu, and Xiangyu Zhang. TRACE: Enterprise-Wide Provenance Tracking for Real-Time APT Detection.IEEE Transactions on Information Forensics and Se...

    2021

  14. [22]

    A Container Security Sur- vey: Exploits, Attacks, and Defenses.ACM Comput

    Omar Jarkas, Ryan Ko, Naipeng Dong, and Redowan Mahmud. A Container Security Sur- vey: Exploits, Attacks, and Defenses.ACM Comput. Surv., 57(7):170:1–170:36, February

  15. [23]

    ORTHRUS: Achieving High Quality of Attribution in Provenance-based Intrusion Detection Systems

    Baoxiang Jiang, Tristan Bilot, Nour El Madhoun, Khaldoun Al Agha, Anis Zouaoui, Shahrear Iqbal, Xueyuan Han, and Thomas Pasquier. ORTHRUS: Achieving High Quality of Attribution in Provenance-based Intrusion Detection Systems. InProceedings of the 34th USENIX Conference on Secu...

    2025

  16. [24]

    PostMark: A New File System Benchmark

    Jeffrey Katcher. PostMark: A New File System Benchmark. Technical Report TR-3022, Network Appliance (NetApp), 1997

    1997

  17. [25]

    Towards Secure Provenance in the Cloud: A Survey

    Brian Lee, Abir Awad, and Mirna Awad. Towards Secure Provenance in the Cloud: A Survey. In2015 IEEE/ACM 8th International Conference on Utility and Cloud Computing (UCC), pages 577–582. IEEE, December 2015

    2015

  18. [26]

    LogKernel: A Threat Hunting Ap- proach Based on Behaviour Provenance Graph and Graph Kernel Clustering.Security and Communication Networks, 2022(1):4577141, 2022

    Jiawei Li, Ru Zhang, Jianyi Liu, and Gongshen Liu. LogKernel: A Threat Hunting Ap- proach Based on Behaviour Provenance Graph and Graph Kernel Clustering.Security and Communication Networks, 2022(1):4577141, 2022. ISSN 1939-0122

    2022

  19. [27]

    Threat detection and investigation with system-level provenance graphs: A survey.Computers & Security, 106:102282, July 2021

    Zhenyuan Li, Qi Alfred Chen, Runqing Yang, Yan Chen, and Wei Ruan. Threat detection and investigation with system-level provenance graphs: A survey.Computers & Security, 106:102282, July 2021. Publisher: Elsevier BV

    2021

  20. [28]

    Secure Namespaced Kernel Audit for Containers

    Soo Yee Lim, Bogdan Stelea, Xueyuan Han, and Thomas Pasquier. Secure Namespaced Kernel Audit for Containers. InProceedings of the ACM Symposium on Cloud Computing, pages 518–532. ACM, November 2021. ISBN 978-1-4503-8638-8. 15

    2021

  21. [29]

    LTTng: an open source tracing framework for Linux, 2005

    LTTng. LTTng: an open source tracing framework for Linux, 2005

    2005

  22. [30]

    httperf—a tool for measuring web server performance

    David Mosberger and Tai Jin. httperf—a tool for measuring web server performance. SIGMETRICS Perform. Eval. Rev., 26(3):31–37, 1998. ISSN 0163-5999

    1998

  23. [31]

    Practical whole-system provenance capture

    Thomas Pasquier, Xueyuan Han, Mark Goldstein, Thomas Moyer, David Eyers, Margo Seltzer, and Jean Bacon. Practical whole-system provenance capture. InProceedings of the 2017 Symposium on Cloud Computing (SoCC). ACM, September 2017. ISBN 978-1-4503- 5028-0

    2017

  24. [32]

    Runtime Analysis of Whole-System Provenance

    Thomas Pasquier, Xueyuan Han, Thomas Moyer, Adam Bates, Olivier Hermant, David Eyers, Jean Bacon, and Margo Seltzer. Runtime Analysis of Whole-System Provenance. In Proceedings of the 2018 ACM SIGSAC Conference. ACM, October 2018

    2018

  25. [33]

    A systematic review of provenance systems.Knowledge and Information Systems, 57(3):495–543, December 2018

    Beatriz Pérez, Julio Rubio, and Carlos Sáenz-Adán. A systematic review of provenance systems.Knowledge and Information Systems, 57(3):495–543, December 2018. ISSN 0219- 3116

    2018

  26. [34]

    Sekar, Hanke Kimm, and Rohit Aich

    R. Sekar, Hanke Kimm, and Rohit Aich. eAudit: A Fast, Scalable and Deployable Audit Data Collection System. In2024 IEEE Symposium on Security and Privacy (SP) Proceed- ings, pages 3571–3589. IEEE, May 2024

    2024

  27. [35]

    Stephen Smalley, Chris Vance, and Wayne Salamon.Implementing SELinux as a Linux security module.NSA, NAI Labs Report, Fort Meade, Maryland, U.S., 2001

    2001

  28. [36]

    strace - the linux syscall tracer, 1991

    strace. strace - the linux syscall tracer, 1991

    1991

  29. [37]

    Sysdig: Linux system exploration and troubleshooting tool with first class support for containers, 2014

    Sysdig. Sysdig: Linux system exploration and troubleshooting tool with first class support for containers, 2014

    2014

  30. [38]

    Ko, and Geoff Holmes

    Yu Shyang Tan, Ryan K.L. Ko, and Geoff Holmes. Security and Data Accountability in Distributed Systems: A Provenance Survey. Inproceedings of the 2013 IEEE 10th Inter- national Conference on High Performance Computing and Communications & 2013 IEEE International Conference on ...

    2013

  31. [39]

    Tetragon - eBPF-based Security Observability and Runtime Enforcement, 2022

    Tetragon. Tetragon - eBPF-based Security Observability and Runtime Enforcement, 2022

    2022

  32. [40]

    Active kernel releases

    The Linux Kernel Organization. Active kernel releases. https://www.kernel.org/category/ releases.html, 2026. Accessed: 2026-06-15

    2026

  33. [41]

    Tracee: Linux Runtime Security and Forensics using eBPF, 2020

    Tracee. Tracee: Linux Runtime Security and Forensics using eBPF, 2020

    2020

  34. [42]

    Verifying the Verifier: eBPF Range Analysis Verification

    Harishankar Vishwanathan, Matan Shachnai, Srinivas Narayana, and Santosh Nagarakatte. Verifying the Verifier: eBPF Range Analysis Verification. In Constantin Enea and Akash Lal, editors,Computer Aided Verification, pages 226–251. Springer Nature Switzerland,

  35. [43]

    Robert N. M. Watson. Exploiting concurrency vulnerabilities in system call wrappers. In Proceedings of the first USENIX workshop on Offensive Technologies, WOOT ’07, pages 1–8. USENIX Association, August 2007

    2007

  36. [44]

    LSMPMON: Performance Evaluation Mecha- nism of LSM-based Secure OS.International Journal of Security and Its Applications, 6 (2):81–90, 2012

    Toshihiro Yamauchi and Kenji Yamamoto. LSMPMON: Performance Evaluation Mecha- nism of LSM-based Secure OS.International Journal of Security and Its Applications, 6 (2):81–90, 2012. 16

    2012

  37. [45]

    Cost-effective Attack Forensics by Recording and Correlating File System Changes

    Le Yu, Yapeng Ye, Zhuo Zhang, and Xiangyu Zhang. Cost-effective Attack Forensics by Recording and Correlating File System Changes. InProceedings of the 33rd USENIX Security Symposium (SEC), pages 1705 – 1722. ACM, 2024

    2024

  38. [46]

    Analyzing the Overhead of Filesystem Protec- tion Using Linux Security Modules

    Wenhui Zhang, Trent Jaeger, and Peng Liu. Analyzing the Overhead of Filesystem Protec- tion Using Linux Security Modules. InProceedings of the 2021 ACM Asia Conference on Computer and Communications Security, pages 393 – 406. ACM, June 2021

    2021

  39. [47]

    Revealing the unstable foundations of ebpf-based kernel extensions

    Shawn Wanxiang Zhong, Jing Liu, Andrea Arpaci-Dusseau, and Remzi Arpaci-Dusseau. Revealing the unstable foundations of ebpf-based kernel extensions. InProceedings of the Twentieth European Conference on Computer Systems, pages 21–41, 2025

    2025

  40. [48]

    Provenance- based Intrusion Detection Systems: A Survey.ACM Computing Surveys, 55(7):1–36, De- cember 2022

    Michael Zipperle, Florian Gottwalt, Elizabeth Chang, and Tharam Dillon. Provenance- based Intrusion Detection Systems: A Survey.ACM Computing Surveys, 55(7):1–36, De- cember 2022. 17 A Robustness analysis Syscalls User-space pointer(s) accept,accept4 upeer_sockaddr, upeer_addr...

    2022

  41. [854]

    ISBN 978-1-891562-49-5

    Internet Society, 2018. ISBN 978-1-891562-49-5

    2018

  42. [2023]

    ISBN 978-3-031-37709-9

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.