2012 · Advances in Software Engineering

A Stateful Approach to Generate Synthetic Events from Kernel Traces

Naser Ezzati-Jivan | Michel R. Dagenais

Evidence basis: full-text-reviewed · Review status: catalog-reviewed; paper-author approval pending

kernel-tracing system-tracing trace-abstraction trace-analysis performance-analysis

stateful trace abstraction synthetic events semantic events modeled state finite-state machine LTTng Linux kernel 2.6.38.6 XML pattern library partial trace abstraction fork bomb SYN flood port scanning

Core contribution: The paper introduces a stateful trace-abstraction method that converts low-level kernel events into semantic and synthetic events using modeled resource state and finite-state patterns.

Catalog abstract summary

The paper presents a stateful approach that maps low-level LTTng events to semantic events and uses modeled resource state and finite-state patterns to generate synthetic events and alarms.

Source: Public open-access article PDF reviewed; abstract paraphrased for this catalog.

Problem and motivation

Low-level LTTng/kernel events are numerous, platform-specific, and difficult to interpret for multi-resource, temporal behavior; stateless pattern matching repeatedly reconstructs state (pp. 1-4).

Method and contribution

A Java/Linux prototype maps raw tracer events to environment-independent semantic events, stores current and historical resource values in a tree/interval-backed modeled-state database, and applies XML finite-state patterns to events, state changes, or both. Patterns generate multi-level synthetic events and alarms, including file, socket, process, system-load, fork-bomb, SYN-flood, and port-scan patterns (pp. 3-8).

Findings and evidence

With Linux kernel 2.6.38.6 and LTTng, traces from 25 MB to 10,000 MB are reduced across abstraction levels. The largest trace has 621,132,167 raw, 159,023,500 first-level, and 2,247,225 second-level events; first-level analysis time is 4,748 ms at 25 MB and 1,105,124 ms at 10,000 MB (pp. 8-12). A 3,622-event wget example yields fewer than 10 synthetic events (p. 8).

Limitations and future directions

Limitations: State transitions cannot express behavior not representable as transitions; cross-process/resource dependency and critical-path analysis are outside the pattern model. Missing tracer state changes can limit correctness, and the prototype has incomplete coverage and hardcoded XML transition actions (pp. 8, 10-12).

Future work: Extend memory and interprocess-communication patterns, complete the host-based intrusion-detection rule base, and develop a more declarative/programming-like language for mappings, state variables, transitions, conditions, and outputs (p. 12, conclusion).

Sources and identifiers

When to cite this paper

Cite this paper when your work uses or compares stateful raw-to-semantic trace abstraction that reuses modeled resource history rather than recomputing state in each pattern.

Citation

BibTeX
@article{ezzatiJivan2012astateful,
  author = {Naser Ezzati-Jivan and Michel R. Dagenais},
  title = {A Stateful Approach to Generate Synthetic Events from Kernel Traces},
  year = {2012},
  journal = {Advances in Software Engineering},
  volume = {2012},
  pages = {1-12},
  publisher = {Hindawi Limited},
  issn = {1687-8655, 1687-8663},
  doi = {10.1155/2012/140368},
  url = {https://doi.org/10.1155/2012/140368}
}
Other citation formats for Word and reference managers
APA 7
Ezzati-Jivan, N., & Dagenais, M. R. (2012). A Stateful Approach to Generate Synthetic Events from Kernel Traces. Advances in Software Engineering, 2012, 1-12. https://doi.org/10.1155/2012/140368
IEEE
N. Ezzati-Jivan and M. R. Dagenais, "A Stateful Approach to Generate Synthetic Events from Kernel Traces," Advances in Software Engineering, vol. 2012, pp. 1-12, 2012, doi: 10.1155/2012/140368

Readable Markdown record · JSON record · Download RIS