MPI: Multiple Perspective Attack Investigation...
summary
Prototype implements LLVM-based instrumentation plus an annotation miner that identifies top‑level task data structures and injects task IDs into provenance logs; it is integrated with Linux Audit, ProTracer and LPM‑HiFi. Evaluation shows generated provenance graphs are much smaller and semantically richer than event‑loop partitioning (BEEP/ProTracer), additional events for Firefox are far lower, runtime overhead is <1%, and Firefox required about 36 annotations while instrumentation points number in the hundreds–thousands.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:32Attack investigation
- 2:11Dependence Explosion Problems
- 3:53Existing Execution Partitioning Technique
- 4:53BEEP Limitations
- 7:18MPI Overview
- 7:57MPI Workflow
- 8:43Annotation needed
- 10:21Annotating Vim
- 11:34Annotation Example
- 12:31Annotation Miner
- 14:58Thread Model
- 15:51Annotating Firefox
- 16:33Evaluation: Annotations
- 17:28Evaluation: Space Overhead
- 18:38Evaluation: Runtime Overhead Caused By MPI
- 19:10Case Study
- 19:35Traditional Solution
- 21:44Related Work
- 23:03Conclusion
related talks
48mDPTrace: Dual Purpose Trace for Exploitability Analysis of Program Crashes
48mProvenance-Aware Integrity Monitoring with Linux Security Identifiers
31meBPF for Observability: The Good, the Bad, and the Ugly
20mThink eBPF for Kernel Security Monitoring
30mBIN2TL: Visualizing Program Dynamics with Perfetto
48mCapturing 0Day Exploits With Perfectly Placed Hardware Traps
16mHardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing
28mCOFI break