NIGELOG: Protecting Logging Information by Hiding
Multiple Backups in Directories

Tetsuji Takada

Hideki Koike

Graduate School of Information Systems
University of Electro-Communications
Chofu, Tokyo 182-8585 JAPANfzetaka,koikeg@vogue.is.uec.ac.jp

Abstract

This paper proposed a novel method to protect
logging information more securely. The method,
named NIGELOG, produces multiple backups ofthe logging information, hides them in arbitrary
directories, and periodically moves these backups
to other directories. Also, NIGELOG can automatically restore the original logging information by using the backups even if the original leis altered or deleted by intruders. NIGELOG isimplemented as a C++ class library with somestandard software libraries and does not require
additional hardwares such as write-once media.
It is easier to apply NIGELOG to UNIX applications which produces log- les.

are frequently updated and therefore it is dicult to protect them by periodical backup.
This paper proposes a novel method to protect
the logging information. The method, named\NIGELOG1 ," makes multiple backups of thelog-info, hides them in arbitrary directories, andperiodically moves the backups to other directories. Moreover, NIGELOG automatically restores the original log-info by using the backups
even if the original is altered or deleted.
The remainder of this paper is organized asfollows. In section 2, existing log-info protection
methods are summarized. The concept and implementation of NIGELOG are described in section 3 and 4, respectively. Section 5 discusses advantages and limitations of NIGELOG. Section
6 concludes the paper.
21Introduction

Existing Log-info protection
methods

Intrusion detection consists of the collection
Various log-info protection methods have beenof logging information and its analysis. In other proposed to date. In this section, we categorize
words, it is impossible to detect any intrusion these methods in four and discuss their problems.
without the logging information(hereafter cited
as log-info). In order to nd the intrusion, system Write-once media The rst method is to use
write-once media. Since the information
administrators inspect the log-info manually andrecorded in the media is impossible to alintrusion detection systems analyzes the log-infoter, the log-info cannot be altered. It,automatically. On the other hand, intruders try
however, requires to put additional hardto alter or delete the log-info to hide the evidence
ware and system administrators have to exof their intrusion. Therefore, the log-info must bechange the media manually.
protected from malicious alteration even if theintruder successes to invade the system.
Trusted host The second method is to transfer
Some methods protecting the log-info havethe log-info to another reliable host combeen proposed to date. It is, however, dicult toputer. It, however, requires another comrestore valuable information which is lost by theputer to keep the log-info. Also, we must
alteration even if these methods are used. Un1\NIGE" in Japanese means \run away."
like the system con guration les, the log-infoTable 1. Various logging information protection methods and its functions

ensure that the log-info is transfered correctly without any loss.
Access control The third method is to use access control which prohibits normal users
to access the log-info[5]. However, since it
requires special functions provided by operating systems (OS), it cannot be used ingeneral.
Encryption The
last method is touse encryption[1][3]. It makes it harder for
the intruder to alter the log-info. And it
enables to detect alteration. However, thismethod is useless when the intruder deletes
the entire log- les. The lost log-info cannot
be restored.
From these observations, there are two major
problems in existing methods. One is the applicability of the methods. The methods 1, 2, and 3
require additional hardwares or special functions
provided by operating systems.
The other is the diculty of restoring the lostlog-info. To detect intrusions, the log-info must
be correct. And when the intrusion is detected,
system administrators have to investigate when
the system is invaded, how to invade the system and what the intruder did using the log-info.
These investigation are necessary to recover thesystem correctly or to study about how to copewith such attacks. For this reason, the log-infomust not be deleted.
3NIGELOG: Basic Idea

To address the problems discussed in the previous section, we propose a new log-info protection method, named NIGELOG. In the followings, we describe some features of NIGELOG.

Figure 1. Features of NIGELOG

3.1

Multiple Backups

To keep the log-info more securely, NIGELOG
makes multiple backups of the original log- le.
However, a periodical backup is not appropriate
for our purpose because there is a time delay until the backups have the same contents with theoriginal. NIGELOG was designed to always keep
the same contents of the original.
3.2

Hiding Backups

Although NIGELOG makes multiple backups, if the intruder already knows names of all
backups and directories where the backups aresaved, he/she can alter the log-info easily. Thus,NIGELOG hides the backups into the le systems in order to keep them more securely. The
ways of hiding backups are listed as follows.
 Arbitrary number of backups are created.
 Arbitrary names are given to the backups.

 The backups are hidden into randomly se-lected directories.

 The backups are periodically moved toother directories with di erent names.

The intruder can detect all backups theoretically. For example, the intruder might search
les which have the same contents to the original. However, even if the intruder succeeded tond all backups, NIGELOG had already moved
some of the backups to other directories with different names. It is, therefore, extremely dicultto alter or delete all backups.
3.3

Alteration detection and automatic
restoration

NIGELOG keeps watching not only the original log- les but also the backups in a short period. This makes it possible to detect alterationof the log- les quickly.
When alteration of the original or the backups
is detected, the log-info is automatically restoredfrom other correct backups. Because of this, it
is possible to always provide correct log-info for
intrusion detection systems or system administrators.
By using this automatic detection mechanism,
it is also possible to develop more secure protection system, such as a system which automatically noti es to the system administrator by Email or a system which automatically records thelog-info to write-once media.
4

Implementation

NIGELOG is implemented as a C++ classlibrary and is composed of three modules andeach module runs concurrently using Pthreadlibrary[6].
1. Receiving the logging information
This module (marked "A" in gure 2) receives the log-info from the application andstores it in internal cache. It also removes
the log-info which was already recorded toall backups from the cache. This module
has two functions: one is an interface between NIGELOG and the application, theother is a management process of the internal cache.
2. Collecting the directory information
This module (marked "B" in gure 2) scans
an entire le system and nds directories
where the backups can be written. WhenNIGELOG does not have the directory information, it is impossible to hide backups

Figure 2. Overview of NIGELOG

into the le system. NIGELOG, therefore,
gives higher priority to this module, until
it collects a certain number of directory information.
3. Output the log-info and detecting alteration
This module does the following work.
 output log-info

If there exists a log-info which has not
yet recorded in the log- les in the internal cache, it writes it in the log- le.

 alteration detection

This watches the log- les periodicallyand detects its alteration. It makes
new \extended stat structure" information from the log- le and comparesit with the past one.
\Extended stat structure" is datastructure which integrates stat structure which has status information
about le with \Finger print" madeby one-way hash function.
We
currently use MD5 Message-Digest
Algorithm[7] for making nger print.

 automatic restoration

If any unexpected alteration is detected, this removes the altered logle and restores the original fromother correct backups.

 periodical hiding

This periodically moves the log- lesto other directories and changes theirnames. The le names are randomly
generated using mktemp function andthe directories to hide are selected
randomly from the directory information which was collected previously.
4.1

Generality of NIGELOG

Also, it is easy to introduce NIGELOG into
applications because NIGELOG does not require any additional hardware and special operating system support. Moreover, NIGELOG
was implemented just by using standard software libraries. As was mentioned in section 4.1,NIGELOG is applicable to various applications
running on UNIX environments.

There are various applications which generates the log-info. It is, therefore, desirable that 5.2 Limitations
logging information protection method is applicable to various applications. NIGELOG wasUnfortunately there are some cases that
carefully designed and implemented by consid- NIGELOG fails to protect the log-info. One isering this point.
that the hidden directories and names of all back standard libraries NIGELOG was imple- ups are already known to the intruder. It is, howmented with standard software libraries. It ever, extremely dicult to know them. Anotherfollows the POSIX standard as much as it case is that the application using NIGELOG
is terminated for some reason. In such case,
can including Pthread library.
NIGELOG cannot perform alteration detection
 C++ class library Also, NIGELOG was implemented as a C++ class library. Thus, it or automatic restoration continuously. However,is easy to be used in the applications and any daemon processes cannot work when they
are terminated.
to extend its function.
Second, the security level of the log- les de minimum interface NIGELOG provides pends on the number of directories the backups
only two interface functions: an initializa- can be written. For example, if the application
tion function and an output function. It runs with normal user's authority, NIGELOG
minimizes programmers load to use this li- can write the backups only in the directories
brary.
where the user's write permission is on. There contents independence NIGELOG does not fore, NIGELOG should be used in the applicadepend on the contents of the log-info. tions which are executed by the super user. InTherefore, it is possible to use NIGELOG this case, the number of directories are huge andeven if the log-info is compressed or en- the security level becomes much higher.
crypted.
Finally, the application using NIGELOG consumes
more CPU resource than that withThese features make it easier to apout
NIGELOGbecause NIGELOG has to do
ply NIGELOG to various applications runadditional
processes
continuously. To reducening on UNIX-based environment. Currently,theload,users
canadjust the interval thatNIGELOG runs on SGI IRIX6.5 and Sun MiNIGELOG
watchesandmoves the backups.
crosystems Solaris2.6.
However, the interval time is inversely proportion to the secure level. It is dicult to reduce
the load dramatically.
5 Discussion
The average load of NIGELOG was measured
as follows. We executed NIGELOG for an hour
5.1 Advantages
and measured the CPU load in every 5 seconds.
The load average was calculated from these data
As is described in the previous sections, (Table 2).
NIGELOG produces multiple backups of an original log- le, hides them into directories, andperiodically moves them to other directories. 5.3 Future Work
And NIGELOG watches all log- les periodically,
NIGELOG can detect unexpected alteration ofIn order to keep log-info more securely, wethe log- les. When the alteration are detected, need to implement more secure mechanism for
NIGELOG can restore the lost log-info.
backup.

Table 2. Average CPU load of NIGELOG

 access restriction If a le is removed while ittion by system administrators or intrusion detection systems becomes more reliable.
Programmers can extend NIGELOG easily.
For example, it could be used with write-once
media or it could be extended as a simple intrusion detection system.
Intrusions
increase
moreand more. NIGELOG itself cannot protect all
such intrusions. However, since NIGELOG canprotect the log-info more securely, it will help tomake more secure systems.

is opened, the program can use the le normally but users cannot access to the le any Referencesmore. This can be applied to NIGELOG inorder to hide backups from intruders.
[1] Bruce Schneier, John Kelsey: Cryptographic
Support for Secure Logs on Untrusted Machines,
 dummy backups The one way to ensure theThe Seventh USENIX Security Symposium Prosafety of log-info is to increase the numceedings, USENIX Press, pp. 53-62, (1998).
ber of backups. It is, however, undesirable [2] G.H. Kim, E.H. Spa ord: The Design and Imbecause it increase the system's load. To
plementation of Tripwire: A File System Inovercome this problem, we are thinking totegrity Checker Purdue Technical Report CSDTR-93-071, Purdue University, (1993).
use a dummy backup which does not continuously perform protection process.
[3] Core SDI S.A.: secure syslog,
http://www.core-sdi.com/Core-SDI/
The idea is described as follows. Suppose
english/slogging/ssyslog.html
that a dummy backup was made at time
MT and current time is CT. Then, the [4] syslog-ng, The free software company BalaBit,(1999),
log-info generated until MT was kept in
http://www.balabit.hu/products/syslogthe dummy backup and the log-info generng.html
ated between MT and CT is kept in memCompany: HP Praesidium/ory. If NIGELOG veri es the contents of [5] Hewlett-Packard
VirtualVault White Paper, (1998),
the dummy backup, it can be used as the
http://www.hp.com/security/products/
source information for restoration on the [6] B. Nichols, D. Buttlar, J.P. Farrell: Pthreadoccasion of log-info restoration process.
Programming A POSIX Standard for Better
6Conclusions

This paper proposed NIGELOG: a novel
method to protect log-info more securely. The
main features of NIGELOG are summarized asfollows: making multiple backups
 hiding them into arbitrary directories

 moving them periodically

NIGELOG can automatically restore the original
logging information by using the backups even if
the original le is altered or deleted by intruders.
Also, NIGELOG is designed and implemented byconsidering its generality.
NIGELOG protects the logging information
more securely and therefore the intrusion detec-Multiprocessing, p. 284, O'Reilly, (1996).
[7] R.L. Rivest: RFC1321: The MD5 MessageDigest Algorithm, MIT Laboratory for Computer Science and RSA Data Security, Inc.,(1992).