# Cloud Security Using Fine-Grained Efficient Information Flow Tracking
## 5 Data Leak Prevention Using CloudMonitor
### Implementation
#### 5.3.1 Consumer Side Implementation Perspective  
The implementation of CloudMonitor from the consumer's side aims to provide robust capabilities for tracking information during potential security breaches within cloud environments, particularly focusing on attacks utilizing Secure Shell (SSH) and secure copy (SCP) communication protocols [78; 79]. From the consumer's perspective, CloudMonitor facilitates the visualization of the victim system's process trace during the execution of such attacks.  
A start and termination script is used to start the logging application on the consumer's end before the attack is launched [80]. This is accomplished by delivering a signal to the victim's computer via the SSH protocol to initiate the Netlink-based logging software. When the attack is complete, a signal via the SSH communication protocol will be sent by the start and termination script to the consumer computers to terminate the process logging 30 s after receiving the signal. These 30 s paddings are added to allow consumer-side processes linked to the attack to complete their jobs if they were still running at the time  
Figure 11: The is-nonzero function for instruction level IFT.  
the signal was received. This synchronization method (start and stop signals) enabled the capturing of processes created during the attack's time frame.  
Next, the Netlink-based logging tool is designed in C/C++ to promptly communicate with the Linux kernel via the Netlink kernel module, allowing for the retrieval of process notifications including their Process ID (PID), Parent Process ID (PPID) [81], and executable information. At the end of the Netlink-based logger execution, a log file is generated containing a record of every process executed on the target system during the attack. This log file serves as the foundation for information tracking.  
The visualization component is a Python script that processes the log file generated by the logging instrument. The Python script peruses the log file and initially locates the log entry where receiving the stop signal is achieved. After that, it constructs in-memory dictionary objects for each distinct process using all the available process log data up to the moment when the termination signal was received. Upon completion of its examination of in-memory dictionary objects, the Python script will construct associations between parent and child processes and communicate this information to the Neo4j Database management system [82] using the Neo4j Python driver to generate a process trace graph.  
Neo4j is an open-source and graphing database that provides back-end functionality for applications [83]. Neo4j is a native graphing database because it implements the property graph model methodically down to the storage level. Data is saved exactly as it was white-boarded by developers to be highly scalable for this kind of target environment. Thus, Neo4j was selected as the system of database management for the CloudMonitor due to its adaptable data model, high scalability, simple data retrieval using the homegrown graph query language, and real-time visualization capabilities.