Mount Ghosts: Tracking Emigrant Data with Transient Provenance

Mount Ghosts tracks data that has already left the system by collecting transient provenance about the period of time in which the data may have been copied off of central storage. A ghost object is created and represents this period of time. During operation, Mount Ghosts attaches read processes as inputs to the ghost object. When a data leak occurs, the combination of all the ghost objects and the related processes can provide a complete view of the potential leak and can aid in apprehending malicious users, managing affected data, and notifying impacted personnel. Mount Ghosts modifications are made in the interceptor and observer PASSv2 layers to collect transient provenance on a mount session. Mount Ghosts is implemented in two ways, one which is elegant and broken and another which is hacky and functional. Initial results show that the second implementation works, that new ghost objects can be designated, and that inputs can be attached to the ghost object on reads. More importantly, this work defines new design decisions, suggests future work, identifies obstacles, and solidifies the validity of methods for collecting transient provenance to represent mount sessions. Trials and tribulations are also documented in great detail.