Pervasive binding of labels to system processes
Abstract
It is desirable to be able to gather more forensically valuable audit data from computing systems than is currently done or possible. This is useful for the reconstruction of events that took place on the system for the purpose of digital forensic investigations. In this document, we analyze what kind of information is desired and what is lacking in computing systems. We then propose a mechanism that allows arbitrary information from a system to be propagated based on causality influenced by information flow. We further discuss how to implement such a mechanism for the FreeBSD operating system and present a proof-of-concept implementation that has little overhead compared to the system without label propagation.
Degree
Ph.D.
Advisors
Spafford, Purdue University.
Subject Area
Computer science
Off-Campus Purdue Users:
To access this dissertation, please log in to our
proxy server.