HyperAudit: Protecting Cloud Audit Evidence

Overview

HyperAudit examines why remote storage cannot secure audit evidence that a compromised guest kernel can alter while it remains in a buffer. The series traces a hypervisor-injected, kernel-independent collector, protected memory and buffers, and a Secure VM that receives, interprets, compresses, and persists syscall records asynchronously. Under the paper’s threat model and tested conditions, this design can protect pre-compromise syscall evidence and reduce synchronous overhead. Its guarantee still depends on the trusted hypervisor and Secure VM, finite capacity, syscall-level coverage, and cloud governance.

Learning outcomes

Remote storage cannot protect audit records that a compromised guest kernel alters before submission.
HyperAudit moves the collector and pending buffer under Secure Hypervisor control, separating workload execution from evidence custody.
Asynchronous transfer reduces recurring synchronous overhead, but finite buffers can still create backpressure and temporary blocking.
The strongest guarantee covers pre-compromise syscall logs and assumes a trusted hypervisor and Secure VM.
HyperAudit strengthens one collection layer; it does not replace policy, correlation, retention, detection, or governance.

Keywords

HyperAuditauditinghypervisorloggingkernelsyscallintegritybuffersSecure VMcloud

Chapters

HyperAudit: Audit Evidence Before Storage

Why buffers and kernel authority decide trust

9 min · Why buffers and kernel authority decide trust

9 min

HyperAudit: The Race Before Log Commit

How timing turns a buffer into an attack surface

9 min · How timing turns a buffer into an attack surface

9 min

HyperAudit: Audit Evidence Custody

How the guest, hypervisor, and Secure VM divide control

8 min · How the guest, hypervisor, and Secure VM divide control

8 min

HyperAudit: A Trust Boundary Model

Who generates, alters, commits, and vouches for logs

8 min · Who generates, alters, commits, and vouches for logs

8 min

HyperAudit: Keeping the Collector Out of Reach

Hidden loading and higher-privilege memory controls

9 min · Hidden loading and higher-privilege memory controls

9 min

HyperAudit: Reconstructing Syscall Meaning

Capture raw facts first, interpret them in the Secure VM

8 min · Capture raw facts first, interpret them in the Secure VM

8 min

HyperAudit: Tested Performance and Limits

What benchmarks show about loss, overhead, and capacity

13 min · What benchmarks show about loss, overhead, and capacity

13 min

HyperAudit: Limits of Protected Auditing

What trust, coverage, capacity, and governance still require

11 min · What trust, coverage, capacity, and governance still require

11 min

Preview every chapter · Unlock full text, audio, and video from chapter 4

Plans

Ch.1-3 FreeCh.4-8 Premium

FAQ

Why is remote log storage not enough in HyperAudit after a guest-kernel compromise?

Remote storage cannot protect records that the compromised guest kernel altered or deleted before they arrived; it protects only surviving records after submission.

What does HyperAudit protect?

HyperAudit protects the collector and pending buffer from a guest-level attacker, preserving pre-compromise syscall evidence under its trusted-hypervisor and Secure VM assumptions.

Why can HyperAudit use asynchronous logging?

HyperAudit can use asynchronous logging because the hypervisor protects pending records from the guest kernel; finite buffers still require backpressure or temporary blocking when consumers fall behind.

Does HyperAudit provide a complete audit program?

No. HyperAudit strengthens syscall collection, but policy, event coverage, correlation, retention, detection, capacity planning, and governance remain necessary.