PANDAcap: A framework for streamlining the capture of PANDA execution traces

栏目: IT技术 · 发布时间: 4年前

内容简介:PANDAcap is a framework for streamlining the capture ofYou can read more about PANDAcap in our

PANDAcap

PANDAcap: A framework for streamlining the capture of PANDA execution traces

PANDAcap is a framework for streamlining the capture of PANDA execution traces. The main goal of PANDAcap is to make it easier to create datasets of PANDA traces . PANDAcap offers support for Docker as well as support for runtime customization of both Docker containers and the VMs used to capture the traces. It relies on the recctrl PANDA plugin to automate starting and stopping of recording. The plugin has been developed for use with PANDAcap and later merged with the PANDA mainline.

You can read more about PANDAcap in our EuroSec 2020 paper :

  • Manolis Stamatogiannakis, Herbert Bos, and Paul Groth. PANDAcap: A Framework for Streamlining Collection of Full-System Traces. In Proceedings of the 13th European Workshop on Systems Security , EuroSec '20 , Heraklion, Greece, April 2020. doi: 10.1145/3380786.3391396 , preprint: vusec.net

    bibtex (paper)
    @inproceedings{pandacap-eurosec20,
    author = {Stamatogiannakis, Manolis and Bos, Herbert and Groth, Paul},
    title = {{PANDAcap: A Framework for Streamlining Collection of Full-System Traces}},
    booktitle = {Proceedings of the 13th European Workshop on Systems Security},
    series = {EuroSec '20},
    year = {2020},
    month = {April},
    address = {Heraklion, Greece},
    url = {https://doi.org/10.1145/3380786.3391396},
    doi = {10.1145/3380786.3391396},
    keywords = {framework, PANDA, record and replay, docker, honeypot, dataset},
    }
    bibtex (dataset)
    @dataset{pandacap-eurosec20-dataset,
    author = {Stamatogiannakis, Manolis and Bos, Herbert and Groth, Paul},
    title = {PANDAcap SSH Honeypot Dataset},
    year = {2020},
    month = {April},
    publisher = {Zenodo},
    version = {1.0},
    url = {https://doi.org/10.5281/zenodo.3759652}
    doi = {10.5281/zenodo.3759652},
    }

You can download the SSH Honeypot Dataset of PANDA traces described in the EuroSec paper from one of the following links:

Note:Good documentation is hard to do. If a piece of information seems to be missing or is not clear enough, feel free to use the issue tracker or contribute a pull request .

Quickstart

  • Build PANDA as usually and install it. The install path that you specify during configuration must not be different than the location you want to install PANDA inside the docker image. Make sure to include the recctrl plugin in the build.
  • Inspect Makefile.vars in this repo. Documentation for the use of each variable is provided in the comments.
  • If you need to override any of the variables in the file, create a new file called Makefile.local.vars and specify their desired values there.
  • Run make . This will build a Docker image that includes the specified PANDA build. You can check this using make lsimg .
  • Running make help will you provide an overview of what actions can be performed via the Makefile.
  • Run ./scripts/pandacap.py --help to get help on the PANDAcap wrapper.

Docker image

PANDAcap builds a docker image based on baseimage-docker , a minimal Ubuntu-based image with some Docker-realated enhancements. The purpose of the image is to provide a self-contained environment for recording PANDA traces.

Dockerfile overview

Instead of including fine-grained commands inside our Dockerfile, we have opted for squashing them into shell scripts which are invoked in a single bootstrapping step. This avoids creating redundant image checkpoints while building, and is also more elegant than abusing the && operator in the Dockerfile.

The high-level steps of creating a PANDAcap Docker image are:

  • Step 1 : update Ubuntu and install PANDA runtime dependencies
  • Step 2 : bootstrap the Ubuntu environment
  • Step 3 : copy a precompiled version of PANDA in the container

Why a new PANDA docker image?

PANDA source code ships with a couple of Dockerfiles that can be used to create a Docker image. However these docker files are mostly intended for building PANDA in a reproducible environment. This means that a lot of build-time dependencies are dragged in the resulting image, causing unecessary bloat. We felt that for creating a dataset with PANDA, a leaner image that includes only what is required to run PANDA would be preferrable.

Makefile :heart:

Makefile commands

While we appreciate the convenience offered by Docker, we recognize that we are probably only going to need it occasionally in our research field. For this, in addition to the functionality wrapped in the pandacap.py script, we have packed several useful Docker-related commands in the main PANDAcap Makefile. Some of the available commands are presented below. Running make help provides an overview of all the available commands.

  • Image creation and cleanup
    • build : Builds the docker image. It scans the specifie
    • clean-docker : Prunes unused containers and images to recover disk space.
    • clean-files : Removes intermediate files, forcing them to be created again the next file you select the build target.
  • Image/container information
    lsimg
    lscont
    lsaddr
    
  • Shell utilities
    • zsh-% : Starts a login zsh on the container specified by % using docker exec . The specification may be either the container id or the container name.
    • ssh-% : Connects as root to the container specified by % using ssh. The specification should be a container name.
    • clean-ssh : Removes the host keys of all container with an active network configuration from your ssh authorized_keys file. This is useful when you modify the bootstrapping scripts and then rebuild the image. Note that this affects any and all containers with an active network configuration.

Makefile configuration variables

As we have mentioned above, Makefile.vars and Makefile.local.vars are the entry points for configuring PANDAcap. Variables defined there can be passed down and used by other parts of PANDAcap. This happens through the use of j2cli to parse the Makefile variables and render them into Jinja2 templates templates.


以上所述就是小编给大家介绍的《PANDAcap: A framework for streamlining the capture of PANDA execution traces》,希望对大家有所帮助,如果大家有任何疑问请给我留言,小编会及时回复大家的。在此也非常感谢大家对 码农网 的支持!

查看所有标签

猜你喜欢:

本站部分资源来源于网络,本站转载出于传递更多信息之目的,版权归原作者或者来源机构所有,如转载稿涉及版权问题,请联系我们

疯狂的站长

疯狂的站长

温世豪 / 清华大学出版社 / 2010年05月 / 29.00元

受全球性金融危机的影响,就业变得越来越困难,众多青年,包括大学毕业生,无不感到就业的巨大压力,站长这一职业不但创业门槛低,而且还自由自在。其实,搭建一个网站是相当简单的,但要成为一名成功的站长则不那么容易。 本书作者是一名站长,从事互联网相关工作已十余年,自已也在经营一个知名网站,积累了大量网站运营经验。作者结合自身真实的“疯狂”创业经历,以平实、通俗的语言讲述如何从零开始起步,最终成为一名......一起来看看 《疯狂的站长》 这本书的介绍吧!

URL 编码/解码
URL 编码/解码

URL 编码/解码

XML、JSON 在线转换
XML、JSON 在线转换

在线XML、JSON转换工具

RGB CMYK 转换工具
RGB CMYK 转换工具

RGB CMYK 互转工具