Diagnosing missing events in distributed systems with negative provenance

Abstract

When debugging a distributed system, it is sometimes necessary to explain the absence of an event-for instance, why a certain route is not available, or why a certain packet did not arrive. Existing debuggers offer some support for explaining the presence of events, usually by providing the equivalent of a backtrace in conventional debuggers, but they are not very good at answering "Why not?" questions: there is simply no starting point for a possible backtrace. In this paper, we show that the concept of negative provenance can be used to explain the absence of events in distributed systems. Negative provenance relies on counterfactual reasoning to identify the conditions under which the missing event could have occurred. We define a formal model of negative provenance for distributed systems, and we present the design of a system called Y! that tracks both positive and negative provenance and can use them to answer diagnostic queries. We describe how we have used Y! to debug several realistic problems in two application domains: softwaredefined networks and BGP interdomain routing. Results from our experimental evaluation show that the overhead of Y! is moderate.

Automated Discovery of Cross-Plane Event-Based Vulnerabilities in Software-Defined Networking

“…PROVSDN [59] prevents cross-app poisoning attacks in real time using a provenance graph structure to enforce information flow control, and FORENGUARD [62] records previous causal relationships to identify root causes. Negative provenance [65], differential provenance [13], and meta provenance [64] have been proposed to explain why SDN routing events did not occur and to propose bug fixes, but such methods require either a history of traces or reference examples of "good" behavior; furthermore, analysis of SDN applications in those systems must be written in or translated into the Datalog language NDlog prior to analysis. The aforementioned systems record code paths that were taken rather than all potential code paths, which limits their effectiveness in identifying potential vulnerabilities ahead of time.…”

Anomalies Detection and Proactive Defence of Routers Based on Multiple Information Learning

“…However, they neglected the position information of the word since a specific word normally has its unique position in one template. Log correlation analysis: Log correlation techniques [17][18][19] are widely used in the attack diagnosis field. They make causality analysis of DNS logs, HTTP logs, WFP logs and system logs of the communication platform or device.…”

Privacy-preserving network provenance

“…Distributed system debugging [11,54] requires strong confidentiality. An entity that wishes to debug its own system may depend on provenance data from external authorities.…”

“…For distributed system debugging [11,54] and IoT tracking [50] that require strong confidentiality, it is necessary to apply GE1 from Figure 1 with the fragmentation-aware SSEF scheme in Figure 2. For confidentiality, any querier who does not hold the authorized token for a color c would not be able to access the vertices and edges with that color, even if it holds the ciphertext the for entire graph.…”