Provenance-Aware Integrity Monitoring with Linux Security Identifiers
Talkat Linux Security Summit North America 2024 · on Thursday, 2024-04-18· at 14:50· Terrace Suite 1+2·
summary
An eBPF-based collector enriches syscall provenance with SELinux types to compute integrity boundaries and tag processes and files, enabling detection of runtime integrity violations that static MAC misses. Provenance graphlets stream a relational representation (11,256 CIS records in the demo) and surface a multi-step Shellshock confused‑deputy chain; four TTP tags are raised. The prototype uses a kprobe cache of security_sid_to_context, runs with ~1 vCPU and a few hundred MB of RAM, is open source, and requests an in‑kernel/eBPF helper for label lookup. eBPF enrichment SELinux types provenance graphlets low overhead
AI-written summary · about
chapters (13)
- 0:00Providence-aware integrity monitoring
- 3:16Runtime observability in Linux
- 5:49CIS flow system architecture
- 8:56CIS flow data format
- 13:10Providence graphlets for analysis
- 14:55Linux security identifiers
- 18:28Shell shock attack demo
- 20:58Graphlet API and enforcement
- 24:51Integrity rules and attack detection
- 27:45TTP tagging and analysis
- 31:15Comparison with state-of-the-art
- 34:23Future improvements
- 35:45Question and answer session
related talks
29mRuntime Security at Scale With EBPF: Hybrid Detection and Root Cause…
40mExploring Runtime Security and Forensic using eBPF
20mThink eBPF for Kernel Security Monitoring
36meBPF for Runtime Security
33mKernel Runtime Security Instrumentation
14mWill eBPF Save Us From the Next Global Outage?
53mGetting Started with BPF Security Observability
34mHow Clusters Fail Under Attack and How We Detect It at Runtime with eBPF signals