S3 Lab - Software & Systems Security Laboratory

Accurate, Low Cost and Instrumentation-Free Security Audit Logging for Windows

Shiqing Ma, Kyu Hyung Lee, Chung Hwan Kim, Junghwan (John) Rhee, Xiangyu Zhang, and Dongyan Xu

Proceedings of the 31st Annual Computer Security Applications Conference (ACSAC) 2015.

Security, Operating Systems, Program Analysis


Audit logging is an important approach to cyber attack investigation. However, traditional audit logging either lacks accuracy or requires expensive and complex binary instrumentation. In this paper, we propose a Windows based audit logging technique that features accuracy and low cost. More importantly, it does not require instrumenting the applications, which is critical for commercial software with IP protection. The technique is built on Event Tracing for Windows (ETW). By analyzing ETW log and critical parts of application executables, a model can be constructed to parse ETW log to units representing independent sub-executions in a process. Causality inferred at the unit level renders much higher accuracy, allowing us to perform accurate attack investigation and highly effective log reduction.