On the Forensic Validity of Approximated Audit Logs

摘要: Auditing is an increasingly essential tool for the defense of computing systems, but unwieldy nature log data imposes significant burdens on administrators and analysts. To address this issue, a variety techniques have been proposed approximating contents raw audit logs, facilitating efficient storage analysis. However, security value these approximated logs difficult to measure—relative original log, it unclear if retain forensic evidence needed effectively investigate threats. Unfortunately, prior work has only investigated issue anecdotally, demonstrating sufficient retained specific attack scenarios. In work, we gap in literature through formalizing metrics quantifying validity under differing threat models. addition providing quantifiable arguments also identify novel point approximation design space—that events describing typical (benign) system activity can be aggressively approximated, while that encode anomalous behavior should preserved with lossless fidelity. We instantiate notion Attack-Preserving LogApprox, new technique eliminates redundancy voluminous file I/O associated benign process activities. evaluate LogApprox alongside corpus exemplar from demonstrate achieves comparable reduction rates retaining 100% attack-identifying events. Additionally, utilize evaluation illuminate inherent trade-off between performance utility within existing techniques. This thus establishes trustworthy foundations next generation auditing frameworks.