  Recently, APT attacks have frequently happened, which are increasingly
complicated and more challenging for traditional security detection models. The
system logs are vital for cyber security analysis mainly due to their effective
reconstruction ability of system behavior. existing log collection tools built
on ETW for Windows suffer from working shortages, including data loss, high
overhead, and weak real-time performance. Therefore, It is still very difficult
to apply ETW-based Windows tools to analyze APT attack scenarios.
  To address these challenges, this paper proposes an efficient and lossless
kernel log collector called Kellect, which has open sourced with project at
www.kellect.org. It takes extra CPU usage with only 2%-3% and about 40MB memory
consumption, by dynamically optimizing the number of cache and processing
threads through a multi-level cache solution. By replacing the TDH library with
a sliding pointer, Kellect enhances analysis performance, achieving at least 9
times the efficiency of existing tools. Furthermore, Kellect improves
compatibility with different OS versions. Additionally, Kellect enhances log
semantics understanding by maintaining event mappings and application
callstacks which provide more comprehensive characteristics for security
behavior analysis.
  With plenty of experiments, Kellect demonstrates its capability to achieve
non-destructive, real-time and full collection of kernel log data generated
from events with a comprehensive efficiency of 9 times greater than existing
tools. As a killer illustration to show how Kellect can work for APT, full data
logs have been collected as a dataset Kellect4APT, generated by implementing
TTPs from the latest ATT&CK. To our knowledge, it is the first open benchmark
dataset representing ATT&CK technique-specific behaviors, which could be highly
expected to improve more extensive research on APT study.
