USENIX Security '23 - Rethinking System Audit Architectures for High Event Coverage and...

USENIX Security '23 - Rethinking System Audit Architectures for High Event Coverage and Synchronous Log Availability

Varun Gandhi, Harvard University; Sarbartha Banerjee, University of Texas at Austin; Aniket Agrawal and Adil Ahmad, Arizona State University; Sangho Lee and Marcus Peinado, Microsoft Research

Once an attacker compromises the operating system, the integrity and availability of unprotected system audit logs still kept on the computer becomes uncertain. In this paper, we ask the question: can recently proposed audit systems aimed at tackling …

architectures arizona attacker audit austin availability event event coverage gandhi harvard harvard university high lee log marcus microsoft research security state system texas university university of texas at austin usenix usenix security