  System auditing is a crucial technique for detecting APT attacks. However,
attackers may try to compromise the system auditing frameworks to conceal their
malicious activities. In this paper, we present a comprehensive and systematic
study of the super producer threat in auditing frameworks, which enables
attackers to either corrupt the auditing framework or paralyze the entire
system. We analyze that the main cause of the super producer threat is the lack
of data isolation in the centralized architecture of existing solutions. To
address this threat, we propose a novel auditing framework, NODROP, which
isolates provenance data generated by different processes with a
threadlet-based architecture design. Our evaluation demonstrates that NODROP
can ensure the integrity of the auditing frameworks while achieving an average
6.58% higher application overhead compared to vanilla Linux and 6.30% lower
application overhead compared to a state-of-the-art commercial auditing
framework, Sysdig across eight different hardware configurations.
