FOX：用于直接存取NVM托管文件系统的硬件辅助文件审计
FOX: Hardware-Assisted File Auditing for Direct Access NVM-Hosted Filesystems
摘要：
随着新兴的非易失性存储器进入主流市场，一些操作系统开始纳入新的变化和优化。一个主要的操作系统支持是文件的直接访问，这使得能够有效地访问托管在字节可寻址NVM系统中的文件。使用启用DAX的文件系统，可以直接访问文件，类似于使用典型的加载/存储操作访问内存。尽管直接存取的效率很高，但频繁使用的系统调用给系统审计带来了麻烦。文件系统审计是强制性的，并且被广泛使用，因为审计日志可以帮助检测异常、可疑的文件访问，或者在数字取证中用作证据。然而，直接存取调用的频繁和长时间使用使得操作系统或文件系统在初始页面错误之后无法跟踪对共享文件的进程操作。这可能会导致不精确的伤亡分析，并导致错误的结论，攻击检测。为了弥补启用细粒度文件系统审计和利用NVM托管的文件系统的性能之间的紧张关系，我们提出了一种新的硬件辅助审计方案FOX。FOX通过轻量级的硬件-软件更改实现了文件系统审计，可以监控NVM上映射文件的每个读或写事件。此外，我们提出了优化的方案，使审计的灵活性为选定的文件/内存范围。通过在完整的系统模拟器Gem5上对FOX进行原型设计，我们观察到与我们的基线相比，吞吐量降低相对较小，并且额外写入可以接受。与其他基于仪器的软件方案相比，我们的方案是低开销和安全的。
英文摘要：
With emerging non-volatile memories entering the mainstream market, several operating systems start to incorporate new changes and optimizations. One major OS support is the direct-access for files, which enables efficient access for files hosted in byte-addressable NVM systems. With DAX-enabled filesystems, files can be accessed directly similar to memory with typical load/store operations. Despite its efficiency, the frequently used system call of direct access is troublesome for system auditing. File system auditing is mandatory and widely used because auditing logs can help detect anomalies, suspicious file accesses, or be used as an evidence in digital forensics. However, the frequent and long-time usage of direct access call blinds the operating system or file system from tracking process operations to shared files after the initial page faults. This might results in imprecise casualty analysis and leads to false conclusion for attack detection. To remedy the tension between enabling fine-grained file system auditing and leveraging the performance of NVM-hosted file systems, we propose a novel hardware-assisted auditing scheme, FOX. FOX enables file system auditing through lightweight hardware-software changes which can monitor every read or write event for mapped files on NVM. Additionally, we propose the optimized schemes, that enable auditing flexibility for selected files/memory range. By prototyping FOX on a full system simulator, Gem5, we observe a relatively small reduced throughput and an acceptable extra writes compared to our baseline. Compared to other instrumentation-based software schemes, our scheme is low-overhead and secure.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
