System based provenance generates traces captured from
various systems, a representation method for inferring these traces is
a graph. These graphs are not well understood, and current work focuses
on their extraction and processing, without a thorough characterization
being in place. This paper studies the topology of such graphs. We an-
alyze multiple Whole-system-Provenance graphs and present that they
have hubs-and-authorities model of graphs as well as a power law distri-
bution. Our observations allow for a novel understanding of the structure
of Whole-system-Provenance graphs.DARP

Balakrishnan, ND

Bytheway, T

Carata, L

Sohan, R

Soman, J

Watson, RNM

English

SV Buldyrev

D Lusseau

ME Newman

Crossref

Structural Analysis of Whole-System Provenance Graphs

Apollo (Cambridge)

Structural Analysis of Whole-System ProvenanceGraphsJyothish Soman, Thomas Bytheway, Lucian Carata, Nikilesh Balakrishnan,and Ripduman SohanComputer Laboratory, University of Cambridge, UK{firstname.lastname}@cl.cam.ac.ukAbstract. System based provenance generates traces captured fromvarious systems, a representation method for inferring these traces isa graph. These graphs are not well understood, and current work focuseson their extraction and processing, without a thorough characterizationbeing in place. This paper studies the topology of such graphs. We an-alyze multiple Whole-system-Provenance graphs and present that theyhave hubs-and-authorities model of graphs as well as a power law distri-bution. Our observations allow for a novel understanding of the structureof Whole-system-Provenance graphs.1 IntroductionProvenance has become a topic of relevance lately with the advent of multiplesystems which augment the existing ones using provenance [1, 6]. There are mul-tiple WSP capturing systems which can generate detailed data regarding theinteractions happening at the machine level, these are naturally representable asgraphs. For such provenance systems, the structure and evolution of the graphare both relevant in the design and optimisation of the storage, analysis andsynthetic data generators. This has equivalence in other domains such as web-graphs, social networks, road-networks etc. A large volume of work present inliterature support this [7, 2]. For example, the work in [7] presents the analysisof the spread of disease in a human-interaction network. This draws parallelswith security related WSP research.With this aim, we present an analysis of provenance graphs. Process tracesare taken from a set of running machines, and the structure of the graphs so gen-erated are studied. The results are used to present that the graphs are similar instructure to a well studied class of graphs namely, Power-law graphs. Addition-ally, we are able to show that they are similar to a Hubs-and-Authorities modelof graphs [3] In the rest of the paper, nodes, edges and degree are used to onlydiscuss the graph properties. Degree represents the total number of edges, bothincoming and outgoing from a given node.OPUS and PVM: OPUS [1] is a user space provenance system designed fortracking provenance on a system. For this work, it was used to provide a graphrepresentation of the various interactions on a tracked machine, both implicit andexplicit in the form of a graph. In OPUS, a process is considered the active agent,and the changes made by it are tracked. This includes interactions of the processwith files and the I/O systems and its communication with other processes usingpipes and sockets. OPUS uses Provenance-Versioning-Model (PVM) to handlestate changes in entities, this is done with the intention of reducing the numberof false dependencies, and de-densifying the resulting graph.2 Graph types in WSPIn the current context, two set of graph models are relevant, namely power-law graphs and the Hubs-and-Authorities graph model. In this section, we woulddiscuss them in further detail.Power-law graphs: Power-law graphs have a degree distribution of the formn(k) = Axk, where n(k) is the number of nodes with a degree k, and A and xare constants. Such graphs also tend to have a tail in the degree distribution.Examples include human-interaction networks such as social-networks, IMDBactors graphs, web-graphs, email graphs, citation graphs and recommendation-networks, to technological graphs such as Autonomous system graphs, web-graphs etc. [4]. Such graphs are also common in time-evolving graphs whereinteractions (edges) and elements (nodes) are added to an already existing graph.In machines, such a process is possible as a limited number of processes andfiles have a higher probability of addition of incoming edges to them. Longerstanding processes would accumulate both incoming and outgoing edges. Addi-tionally, files and libraries would have multiple processes linking to them overtime. Hence, the number of edges they accumulate would increase, which is inline with the preferential attachment theory.Hubs and Authorities: In Hubs-and-Authorities (HaA) model of Klein-berg [3], each node can be either a hub or an authority. Hubs are nodes whichconnect high relevance nodes, and authorities are representative of the immedi-ate neighbourhood. An authority on the other hand would be specialised nodes,and would only have information regarding a specific issue. HaA model also al-lows for a class of nodes which cannot be classified as either and are disregarded.The equivalent in WSP would be processes being authorities, and files, socketsand other mediums by which they share state being hubs.The power-law graphs and HaA model together can be used to describethe graphs present in WSP . In Section 4, we would present graphs and theirstructural and property similarities to these two models.3 SetupFor the generation of the test graphs, single machine-level traces using DTRACErunning on FREBSD were taken from multiple machines running varied appli-cations. A total of 9 traces are captured on active machines running multipleprocesses. OPUS was used to summarise the graphs and to merge nodes fromthe traces to form a more cohesive view of the traces.4 Results100 101 102 103 104 105Number of nodes100101102103104105DegreeFig. 1: Degree distribution.INFINFINFINFINFINF INFINFINFINFINFINF INFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFININFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINF INF INFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINFINF7509175084750817508675092750877509075101750917509075086Fig. 2: Graph showing all interactionsacross 100 connected elements.The analysis in this section deals with the graph structure, in terms of thedegree distribution and general structure of the graph.Figure 2 shows a small graph from which dangling nodes and nodes withno outgoing edges are removed. In this graph, the community property of thegraph is better visible with two clear groups visible. It is notable that this graphis similar in structure to the dolphin social network [5]. In the dolphin socialnetwork, there are two large groups, one of which is densely connected, and theother one is relatively sparse. In Figure 2, the purple nodes are the processes,red and green are the files, and yellow represents sockets. Processes are centralto the graph, with files providing bridging connection between the nodes. Thisis a recurring structure in the 9 graphs studied in this work. From this, we canextrapolate that similar interactions will be present in traces captured from othermachines as well.Figure 1 shows the degree distribution across all the 9 traces. It can beseen that the power law distribution is followed by all the graphs. Do note thatversioning causes nodes to version, taking along all the active connections to thenext node. Such high degree nodes suggest that certain nodes are able to haveactive connections to a large subset of the system. From a system stability andsecurity perspective, these are high value nodes, and would need to be stable fora large duration of time. Additionally, such nodes would also add pressure onthe storage system, as it would be continously adding edges, and a graph storageengine which does not coalesce storage for the edges of such nodes, would causelarge parts of th storage to be read multiple times.4.1 Effect of graph structure on storage and analyticsFor storage and caching, the presence of high degree nodes can cause significantcache trashing given OPUS like versioning. Access to the properties of the nodesconnected to such a high value node would require multiple accesses to theunderlying storage. These nodes were added to the system earlier and wouldhave varying lifetimes and hence likely to be stored in different parts of thestorage. Thus, a conventional caching mechanism can cause significant cachetrashing, as any such access can lead to a large number of cache-evictions.5 ConclusionsThis paper presents that WSP show a power-law distribution, with processesforming the hubs and the other elements connecting the processes forming theauthorities. The lifetime of a node in the WSP graph is limited and the effectsof such transient nature is also shown. Given the hub-authorities model, the life-time does not affect the power-law model as long-lasting processes accumulatemore edges, and system-critical read-only files do the same. This presents oppor-tunities for not just storage engine, but also to caching, and analysis methodsassociated with the system.References1. Balakrishnan, N., Bytheway, T., Sohan, R., Hopper, A.: OPUS: A lightweightsystem for observational provenance in user space. In: Presented as part of the5th USENIX Workshop on the Theory and Practice of Provenance. USENIX,Lombard, IL (2013), https://www.usenix.org/conference/tapp13/opus-lightweight-system-observational-provenance-user-space2. Buldyrev, S.V., Parshani, R., Paul, G., Stanley, H.E., Havlin, S.: Catastrophic cas-cade of failures in interdependent networks. Nature 464(7291), 1025 (2010)3. Kleinberg, J.M.: Hubs, authorities, and communities. ACM Com-put. Surv. 31(4es) (Dec 1999). https://doi.org/10.1145/345966.345982,http://doi.acm.org/10.1145/345966.3459824. Leskovec, J., Kleinberg, J., Faloutsos, C.: Graphs over time: densification laws,shrinking diameters and possible explanations. In: Proceedings of the eleventh ACMSIGKDD international conference on Knowledge discovery in data mining. pp. 177–187. ACM (2005)5. Lusseau, D., Schneider, K., Boisseau, O.J., Haase, P., Slooten, E., Dawson, S.M.:The bottlenose dolphin community of doubtful sound features a large proportion oflong-lasting associations. Behavioral Ecology and Sociobiology 54(4), 396–405 (Sep2003). https://doi.org/10.1007/s00265-003-0651-y, https://doi.org/10.1007/s00265-003-0651-y6. Muniswamy-Reddy, K.K., Holland, D.A., Braun, U., Seltzer, M.: Provenance-awarestorage systems. In: Proceedings of the Annual Conference on USENIX ’06 AnnualTechnical Conference. pp. 4–4. ATEC ’06, USENIX Association, Berkeley, CA, USA(2006), http://dl.acm.org/citation.cfm?id=1267359.12673637. Newman, M.E.: Spread of epidemic disease on networks. Physical review E 66(1),016128 (2002)

Structural analysis of whole-system provenance graphs

https://www.repository.cam.ac.uk/bitstream/handle/1810/283476/main.pdf?sequence=1&isAllowed=y

Structural analysis of whole-system provenance graphs

Abstract

Similar works

Full text

Available Versions

Crossref

Apollo (Cambridge)