In cloud-based endpoint auditing, security administrators often rely on the cloud to perform causality analysis over log-derived versioned provenance graphs to investigate suspicious attack behaviors. However, the cloud may be distrusted or compromised by attackers, potentially manipulating the final causality analysis results. Consequently, administrators may not accurately understand attack behaviors and fail to implement effective countermeasures. This risk underscores the need for a defense scheme to ensure the integrity of causality analysis. While existing tamper-evident logging schemes and trusted execution environments show promise for this task, they are not specifically designed to support causality analysis and thus face inherent security and efficiency limitations. This paper presents vCause, an efficient and verifiable causality analysis system for cloud-based endpoint auditing. vCause integrates two authenticated data structures: a graph accumulator and a verifiable provenance graph. The data structures enable validation of two critical steps in causality analysis: (i) querying a point-of-interest node on a versioned provenance graph, and (ii) identifying its causally related components. Formal security analysis and experimental evaluation show that vCause can achieve secure and verifiable causality analysis with only <1% computational overhead on endpoints and 3.36% on the cloud.

翻译：在云端端点审计中，安全管理员通常依赖云端对日志衍生的版本化溯源图进行因果分析，以调查可疑攻击行为。然而，云端可能不可信或遭受攻击者入侵，从而可能操纵最终的因果分析结果。这导致管理员可能无法准确理解攻击行为，进而无法实施有效的应对措施。这一风险凸显了需要一种防御方案来确保因果分析的完整性。尽管现有的防篡改日志方案与可信执行环境在此任务中展现出潜力，但它们并非专门为支持因果分析而设计，因此面临固有的安全性与效率限制。本文提出vCause，一种面向云端端点审计的高效可验证因果分析系统。vCause集成了两种认证数据结构：图累加器与可验证溯源图。这些数据结构支持对因果分析中两个关键步骤的验证：（i）在版本化溯源图上查询兴趣点节点，以及（ii）识别其因果关联组件。形式化安全分析与实验评估表明，vCause能够以仅<1%的端点计算开销和3.36%的云端开销实现安全可验证的因果分析。