[Paper Review] Retrofitting Applications with Provenance-Based Security Monitoring

Adam Bates, Kevin Butler+5 more|arXiv (Cornell University)|Sep 1, 2016

Scientific Computing and Data Management36 references3 citations

TL;DR

This paper presents DAP, a transparent, low-overhead framework for retrofitting web applications with fine-grained data provenance without code changes. By interposing on database communications and leveraging SQL syntax awareness, DAP captures detailed provenance with under 5.1 ms end-to-end request overhead, enabling real-time detection and prevention of SQL injection and data exfiltration attacks while minimizing storage through garbage collection optimization.

ABSTRACT

Data provenance is a valuable tool for detecting and preventing cyber attack, providing insight into the nature of suspicious events. For example, an administrator can use provenance to identify the perpetrator of a data leak, track an attacker's actions following an intrusion, or even control the flow of outbound data within an organization. Unfortunately, providing relevant data provenance for complex, heterogenous software deployments is challenging, requiring both the tedious instrumentation of many application components as well as a unified architecture for aggregating information between components. In this work, we present a composition of techniques for bringing affordable and holistic provenance capabilities to complex application workflows, with particular consideration for the exemplar domain of web services. We present DAP, a transparent architecture for capturing detailed data provenance for web service components. Our approach leverages a key insight that minimal knowledge of open protocols can be leveraged to extract precise and efficient provenance information by interposing on application components' communications, granting DAP compatibility with existing web services without requiring instrumentation or developer cooperation. We show how our system can be used in real time to monitor system intrusions or detect data exfiltration attacks while imposing less than 5.1 ms end-to-end overhead on web requests. Through the introduction of a garbage collection optimization, DAP is able to monitor system activity without suffering from excessive storage overhead. DAP thus serves not only as a provenance-aware web framework, but as a case study in the non-invasive deployment of provenance capabilities for complex applications workflows.

Motivation & Objective

• To address the lack of holistic, affordable provenance support in complex, heterogeneous web service deployments.
• To overcome semantic gap problems in system-level provenance by capturing application-level semantics without instrumentation.
• To enable real-time detection and prevention of data exfiltration and SQL injection attacks through precise provenance tracking.
• To reduce storage bloat in provenance collection via a novel garbage collection optimization.
• To provide a unified, interoperable provenance model across diverse components in a web workflow.

Proposed method

• DAP employs transparent interposition on database connections to observe and parse SQL queries and results, extracting provenance without modifying applications.
• It leverages minimal knowledge of SQL syntax to infer data lineage and workflow structure, enabling precise provenance reconstruction.
• The system aggregates provenance from multiple sources—especially database transactions—into a unified, namespace-consistent graph.
• A garbage collection optimization is introduced to prune obsolete provenance records, drastically reducing long-term storage overhead.
• Policy enforcement is decoupled from the data collection layer and applied at a network guard, allowing high-level, cross-query policies.
• The architecture is designed to be compatible with existing web services and requires no developer cooperation or instrumentation.

Experimental results

Research questions

• RQ1 Can provenance be collected transparently in existing web services without application instrumentation?
• RQ2 Can a system achieve fine-grained, application-level provenance with minimal performance overhead?
• RQ3 Can provenance be used effectively to detect and prevent SQL injection and data exfiltration attacks in real time?
• RQ4 How can provenance storage overhead be minimized in long-running, high-throughput workflows?
• RQ5 Can provenance from disparate sources (e.g., database, network) be unified under a common model for policy enforcement?

Key findings

• DAP imposes less than 5.1 ms of end-to-end overhead on web requests, demonstrating minimal performance impact.
• The system captures detailed, human-readable provenance graphs by analyzing SQL queries and responses without modifying the application.
• The garbage collection optimization significantly reduces storage overhead, making long-term provenance logging feasible.
• DAP enables detection and prevention of SQL injection-based data exfiltration by tracking data lineage from database queries to network responses.
• The framework supports real-time policy enforcement across multiple database operations, allowing high-level security policies beyond per-query restrictions.
• DAP is compatible with a large percentage of existing web services and requires no changes to the application or database engine.