English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

System auditing is a crucial technique for detecting APT attacks. However,attackers may try to compromise the system auditing frameworks to conceal theirmalicious activities. In this paper, we present a comprehensive and systematicstudy of the super producer threat in auditing frameworks, which enablesattackers to either corrupt the auditing framework or paralyze the entiresystem. We analyze that the main cause of the super producer threat is the lackof data isolation in the centralized architecture of existing solutions. Toaddress this threat, we propose a novel auditing framework, NODROP, whichisolates provenance data generated by different processes with athreadlet-based architecture design. Our evaluation demonstrates that NODROPcan ensure the integrity of the auditing frameworks while achieving an average6.58% higher application overhead compared to vanilla Linux and 6.30% lowerapplication overhead compared to a state-of-the-art commercial auditingframework, Sysdig across eight different hardware configurations.

Auditing Frameworks Need Resource Isolation: A Systematic Study on the Super Producer Threat to System Auditing and Its Mitigation