A Study of Kernel Telemetry Options for Security-Oriented Provenance

2026-08-11

AI Summary

Existing provenance tracing systems struggle to simultaneously ensure security, integrity, and availability in production environments. This study presents the first systematic classification and evaluation of eight provenance systems and five capture agents, with a focus on the heterogeneity and security weaknesses of their underlying kernel telemetry mechanisms. Leveraging eBPF for fine-grained event filtering—such as container-level monitoring—and employing microbenchmarks to analyze performance overhead, the work reveals that most tools fail to guarantee the integrity and availability of event data, rendering them inadequate for security-critical scenarios. The findings provide an empirical foundation and design guidance for building high-fidelity, low-overhead provenance capture systems suitable for real-world deployment.

Abstract

Provenance aims to capture the origins, transformations, and interactions of system objects for security and forensic applications. Existing provenance capture approaches still face major challenges and are not yet ready for production environments. In this paper, we first analyze the main kernel telemetry capture approaches, identifying eBPF as the most promising, and complement this analysis with micro benchmarks to assess its performance overhead and the filtering mechanisms used to achieve capture granularity, such as restricting capture to individual containers. Building on this foundation, we then classify, according to the studied capture approaches and filtering methods, eight provenance systems and five capture agents that could serve as their capture layers, collectively referred to as tools. Our study reveals that these tools are built on highly heterogeneous capture layers, most of which cannot guarantee the integrity and availability of the captured events, completely failing to meet the requirements of security-oriented use cases.

Problem

• provenance
• kernel telemetry
• security
• integrity
• availability

Innovation

• eBPF
• kernel telemetry
• provenance
• security
• capture granularity