Rethinking Provenance Completeness with a Learning-Based Linux Scheduler

2025-10-09

AI Summary

Existing provenance systems face the “super-producer threat,” causing event overload and risking the loss of critical security events; conventional resource isolation approaches are constrained by hardware dependencies and performance bottlenecks, undermining provenance integrity. This paper proposes Venus—the first reinforcement learning–based kernel-level scheduler that tightly couples provenance task behavioral modeling with Linux scheduling decisions to enable dynamic, adaptive resource isolation and priority-based scheduling. Its core innovation lies in explicitly linking scheduling policies to provenance semantics—ensuring high-risk events are neither deprioritized nor dropped. Experimental evaluation demonstrates that Venus achieves up to a 39.2% improvement in provenance event capture completeness while imposing minimal runtime overhead (<8% CPU utilization), consistently outperforming the CFS scheduler across diverse multi-workload scenarios.

Technology Category

• Planning, Routing, and Scheduling: Scheduling under Uncertainty
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust
• Multiagent Systems: Adversarial Agents

Application Category

• Security and Privacy: Data transparency and provenance
• Systems and Infrastructure for Web, Mobile and WoT: Virtualization and resource management in Web systems and infrastructures
• Semantics and Knowledge: Provenance, trust, security and privacy, and ethical issues in managing semantic data

Abstract

Provenance plays a critical role in maintaining traceability of a system's actions for root cause analysis of security threats and impacts. Provenance collection is often incorporated into the reference monitor of systems to ensure that an audit trail exists of all events, that events are completely captured, and that logging of such events cannot be bypassed. However, recent research has questioned whether existing state-of-the-art provenance collection systems fail to ensure the security guarantees of a true reference monitor due to the'super producer threat'in which provenance generation can overload a system to force the system to drop security-relevant events and allow an attacker to hide their actions. One approach towards solving this threat is to enforce resource isolation, but that does not fully solve the problems resulting from hardware dependencies and performance limitations. In this paper, we show how an operating system's kernel scheduler can mitigate this threat, and we introduce Venus, a learned scheduler for Linux specifically designed for provenance. Unlike conventional schedulers that ignore provenance completeness requirements, Venus leverages reinforcement learning to learn provenance task behavior and to dynamically optimize resource allocation. We evaluate Venus's efficacy and show that Venus significantly improves both the completeness and efficiency of provenance collection systems compared to traditional scheduling, while maintaining reasonable overheads and even improving overall runtime in certain cases compared to the default Linux scheduler.

Problem

• Mitigating super producer threat in provenance collection systems
• Ensuring event completeness despite system overload risks
• Optimizing resource allocation for provenance tasks via learning

Innovation

• Uses reinforcement learning for provenance task behavior
• Learned scheduler dynamically optimizes resource allocation
• Linux scheduler improves provenance completeness and efficiency