Sound and clear provenance tracking for microservice deployments
Inventors
Yegneswaran, Vinod • GEHANI, Ashish • IRSHAD, Hassaan • Chen, Xutong • Chen, Yan
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-12474939-B2
Publication Date
2025-11-18
Expiration Date
Abstract
Embodiments consistent with the present disclosure provide systems and methods for providing namespace-aware provenance tracking in a containerized environment. In some embodiments, methods for providing namespace-aware provenance tracking in a containerized environment may include monitoring, by one or more custom kernel hooks, event audit records from an OS kernel, wherein the one or more custom kernel hooks extend the functionality of the OS kernel; augmenting the event audit records from the OS kernel with one or more additional namespace aware audit records that include namespace information related to the container associated with event audit records, wherein the namespace information related to the container includes namespace IDs; processing, by an audit reporter, the namespace aware audit records to interpret the namespace IDs contained within the namespace aware audit records; and creating namespace-aware provenance graph that is namespace and container aware based on the namespace aware audit records.
Core Innovation
The invention provides namespace-aware provenance tracking in a containerized environment by extending OS kernel audit mechanisms with one or more custom kernel hooks. The method monitors event audit records from an operating system (OS) kernel when specific required namespace related information is not captured in the event audit records, and augments the records with one or more additional namespace aware audit records that include namespace information determined by the custom kernel hooks, where the namespace information related to the container includes namespace IDs.
An audit reporter processes at least the additional namespace aware audit records to interpret the namespace IDs and creates a namespace-aware provenance graph that is namespace and container aware based on the namespace aware audit records. The approach addresses missing namespace semantics in provenance tracking by using kernel-derived namespace information to improve provenance graph accuracy, and the namespace-aware provenance graph is used for handling security policy violations by a machine learning system.
The document further describes namespace and container awareness by using additional extracted mapping context derived from kernel event audit records to support namespace and container awareness. It specifies that the approach can monitor Linux namespaces including PID, User, Mount, Network, and IPC, and postprocessing can be used to analyze the namespace-aware provenance graph to identify a container boundary and identify a subgraph related to container initialization.
Claims Coverage
The independent claims include a method, a system, and non-transitory computer readable media. Across these independent claims, the coverage centers on using custom kernel hooks to augment OS kernel event audit records with namespace IDs, using an audit reporter to interpret those IDs to create a namespace-aware provenance graph, and using a machine learning system to handle security policy violations with the resulting graph. Three inventive features are repeatedly required.
Namespace-aware provenance tracking with custom kernel hook augmentation and graph-based policy violation handling
monitoring, by one or more custom kernel hooks, event audit records from an operating system (OS) kernel in response to determining that specific required namespace related information was not captured in the event audit records; augmenting, by the one or more custom kernel hooks, the event audit records from the OS kernel with one or more additional namespace aware audit records that include namespace information determined by the one or more custom kernel hooks and related to a container in the containerized environment associated with the event audit records, wherein the namespace information related to the container includes namespace IDs; processing, by an audit reporter, at least the additional namespace aware audit records to interpret the namespace IDs contained within the namespace aware audit records; creating by the audit reporter, a namespace-aware provenance graph that is namespace and container aware based on the namespace aware audit records; and handling, by a machine learning system, security policy violations using the namespace-aware provenance graph.
Namespace-aware provenance tracking system with custom kernel hooks, audit reporter graph creation, and machine learning security policy violation handling
one or more custom kernel hooks configured to monitor event audit records from an operating system (OS) kernel in response to determining that specific required namespace related information was not captured in the event audit records, wherein the one or more custom kernel hooks extend functionality of the OS kernel in the containerized environment; augment the event audit records from the OS kernel with one or more additional namespace aware audit records that include namespace information determined by the one or more custom kernel hooks and related to a container in the containerized environment associated with the event audit records, wherein the namespace information related to the container includes namespace IDs; an audit reporter configured to process at least the additional namespace aware audit records to interpret the namespace IDs contained within the namespace aware audit records; create a namespace-aware provenance graph that is namespace and container aware based on the namespace aware audit records; and handle, by a machine learning system, security policy violations using the namespace-aware provenance graph.
Non-transitory computer readable media performing namespace-aware provenance tracking with custom kernel hooks and provenance graph security policy handling
monitoring, by one or more custom kernel hooks, event audit records from an operating system (OS) kernel in response to determining that specific required namespace related information was not captured in the event audit records, wherein the one or more custom kernel hooks extend functionality of the OS kernel in the containerized environment; augmenting, by the one or more custom kernel hooks, the event audit records from the OS kernel with one or more additional namespace aware audit records that include namespace information determined by the one or more custom kernel hooks and related to a container in the containerized environment associated with the event audit records, wherein the namespace information related to the container includes namespace IDs; processing, by an audit reporter, at least the additional namespace aware audit records to interpret the namespace IDs contained within the namespace aware audit records; and creating by the audit reporter, a namespace-aware provenance graph that is namespace and container aware based on the namespace aware audit records; and handling, by a machine learning system, security policy violations using the namespace-aware provenance graph.
Across the independent claims, the inventive coverage is consistent: custom kernel hooks determine when required namespace related information is missing from OS kernel event audit records and augment those records with additional namespace aware audit records including namespace IDs; an audit reporter interprets the namespace IDs to create a namespace- and container-aware provenance graph; and a machine learning system handles security policy violations using that provenance graph.
Stated Advantages
Improved provenance graph accuracy with acceptable overhead (<5%) across container engines and attacks.
Documented Applications
Handling security policy violations using the namespace-aware provenance graph.
Interested in licensing this patent?