eAudit

About the software

This is the eAudit suite for recording provenance-related system calls using the Linux ebpf framework, and to subsequently print this information in a human-readable format. This initial release accompanies our research paper at IEEE Symposium on Security and Privacy, 2024.


System call logs are the last line of defense against sophisticated cyber attacks, providing a detailed and causally complete record for post-attack investigation. This use requires logging to be enabled at all times, but unfortunately, existing systems for system call logging do not seem to have been designed or engineered for such use. Consequently, they are prone to losing a large fraction of events during peak loads, and moreover, introduce significant performance and storage overheads. We developed eAudit to mitigate these drawbacks, and to enable "always on" audit logging. Our specific goals are to:



We anticipate continued development of this software, with future additions focused on reducing the data volume, further improving the performance and robustness, and providing an API for system call analysis tools.


This software is organized as follows:


Source Code

The software can be downloaded from https://github.com/seclab-stonybrook/eaudit

License

This software release is governed by GPL v3 copyright license. https://github.com/seclab-stonybrook/eaudit/blob/master/LICENSE


Prerequisites and Installation

https://github.com/seclab-stonybrook/eaudit/blob/master/INSTALL.md


Usage

There are two top-level programs: ecapd and eaudit. ecapd is for logging system calls, while eaudit is used to parse/print the collected logs in a human readable format. Being based on ebpf, ecapd requires root privilege to run. Both programs support a -h option that prints a help message documenting the command-line options.


Behind the scenes

ecapd is a wrapper shell script that invokes eauditd.py, which loads and manages the ebpf code in eauditk.c. eauditd.py also loads the code from eauditd.C and sets it up to read the captured data (from ebpf's ring buffer) and write it into the capture file.


eaudit.C and eParser.C contain the code that compiles into eaudit, the program that parses capture files and produces a human-readable output. eauditk.c is compiled on the fly and loaded into the kernel by eauditd.py.


Publication

eAudit: A Fast, Scalable and Deployable Audit Data Collection System

R. Sekar, Hanke Kimm, and Rohit Aich,

Stony Brook University, NY, USA.