Scrub-PA DownLoad Web Page

Scrub-Process Accounting (PA) Page

What is Scrub-PA?

SCRUB-PA is a tool that uses multi-level multi-dimensional anonymization on process accounting log files in order to provide different levels of privacy protection. It is known that process accounting data is sensitive since it contains private user information and thus security system administrators have been hindered from sharing these logs. Given that many interesting security applications could use process accounting data, it would be useful to have a tool that could protect private user information in the logs. For that purpose we've designed and developed SCRUB-PA. Our goal is to promote the sharing of process accounting logs while preserving privacy.

Go to the top!

Papers Describing Scrub-PA

For more detailed description of Scrub-PA motivation, goals, and usage visit our Scrub-PA publications and the manual-like technical report on SCRUB-PA published in the ACM CORR.

Go to the top!

System Architecture

Figure 1: Overview of SCRUB-PA system architecture

The general system architecture of SCRUB-PA is shown in Figure 1. SCRUB-PA consists of the two main modules: (1) the SCRUB-PA GUI and (2) the read/write engines. The SCRUB-PA GUI accepts user anonymization options, sends the request to the processing engine and summarizes the results of the performed actions in a pop-up window. First, the reader engine reads the process accounting data record from the source file and parses it into its component fields. Next it sends the unanonymized data to the anonymization engine. The anonymization engine houses a collection of anonymization algorithms, and it anonymizes the data according to the user's chosen options before it sends the data back to the write engine. The write engine reassembles the anonymized data and writes the records to the destination file. Statistics are collected and sent back to the GUI which displays them in a new window.

Go to the top!

Getting Scrub-PA

Package	Download
Scrub-PA	Download

Go to the top!

Installation Instructions

Windows Instructions: After downloading, double-click Scrub-PA.exe

Linux Instructions:

After downloading open a shell and, cd to the directory where you downloaded the installer
At the prompt type: sh ./ScrubPA.bin

Go to the top!

Manual

Anonymization

Several anonymization algorithms have been used in the tool SCRUB-PA in the context of different process accounting fields. These methods are listed below and describedin detail in our papers, especially the ACM CORR Technical Report.

Black Marker Anonymization
Pure Randomization
Keyed Randomization
Grouping
Truncation
Random Shift
Enumeration

Next, we present the process accounting fields along with a short description.

ac_comm	Command name
ac_uid	User ID associated with the process
ac_gid	Group ID associated with the process
ac_tty	TTY which sent the command to launch the process
ac_btime	Beginning system time for the process
ac_utime	Time spent in user space for the process
ac_stime	Time spent in kernel space for the process (accurate to 0.01 second)
ac_etime	Total elapsed time for the process (greater than or equal to ac_utime + ac_stime) also known as “wall clock” or real-time (accurate to a second)
ac_mem	Average amount of memory in units of 8K (pages) that is used by the process
ac_rw	Number of blocks read or written by the process
ac_io	Number of characters transferred by the process
ac_minflt	Number of minor pagefaults. Minor pagefaults do not require physical I/O. Any process doing a read or write to something that is in the page will get a minor page fault
ac_majflt	Number of major page faults. Major pagefaults cause pages to be read from disk including pages read from buffer cache.
ac_swaps	Number of memory swaps
ac_exitcode	A status code that indicates how the process terminated
ac_flag	Accounting flags

The first step in using SCRUB-PA is selecting an input file containing process accounting data. Figure 2A shows the main menu with the input file selection window highlighted. The input file name can be typed in or filled in by selecting it through the file browser. The output file can be designated similarly.

Figure 2A also shows the main menu with the output file selection window highlighted. If an existing file is selected then SCRUB-PA will verify with a user window whether the file should be overwritten.

Figure 3B shows the task summary window that appears immediately after the anonymization tasks are complete and an output file has been created. The task summary window documents all the anonymization operations and parameters performed on the input file resulting in the output file (except for the seed keys which are not documented). This metadata about anonymization operations on a specific input-to-output file transaction can be saved or printed to provide a record for future reference since no metadata is kept in the processing accounting files themselves.


Figure 2A	Figure 2B

SCRUB-PA provides multi-level anonymization for each field (eg. Black Marker, Pure Randomization etc.) By clicking in the circle next to the selected anonymization option, the information about that option will become highlighted/darken while the other unselected options will become faded. Anonymization options for each field are mutually exclusive (no more than one anonymization option per field may be selected) and independent (selection in one field does not affect other fields). Although one anonymization option is selected as a default for each field (usually the first option) no anonymization option needs to be selected.

Once we have chosen the desired anonymization options and we have designated input/output files we are ready to start the anonymization process by clicking the "Start" button. The progress bar on the botom right corner shows us the progress of the anonymization.

Go to the top!

Mailing List

To subscribe to Scrub-PA mailing list, send mail to ncsalist@ncsa.uiuc.edu or majordomo@ncsa.uiuc.edu with the body of message containing the single line:
subscribe Scrub-PA

Visit archives of the Scrub-PA Mailing list to search/browse through other posted questions and answers.

Go to the top!

Contacts

We encourage you to use the mailing list to post any questions you have about Scrub-PA.
Other alternatives:

Go to the top!

Scrub-Process Accounting (PA) Page

Menu