A Study of Kernel Telemetry Options for Security-Oriented Provenance

Computer Science > Cryptography and Security [Submitted on 11 Aug 2026] A Study of Kernel Telemetry Options for Security-Oriented Provenance Paul R. B. Houssel, Olivier Levillain, Sylvie Laniepce, Nicolas Dejon, Hervé Debar Provenance aims to capture the origins, transformations, and interactions of system objects for security and forensic applications. Existing provenance capture approaches still face major challenges and are not yet ready for production environments. In this paper, we first analyze the main kernel telemetry capture approaches, identifying eBPF as the most promising, and complement this analysis with micro benchmarks to assess its performance overhead and the filtering mechanisms used to achieve capture granularity, such as restricting capture to individual containers. Building on this foundation, we then classify, according to the studied capture approaches and filtering methods, eight provenance systems and five capture agents that could serve as their capture layers, collectively referred to as tools. Our study reveals that these tools are built on highly heterogeneous capture layers, most of which cannot guarantee the integrity and availability of the captured events, completely failing to meet the requirements of security-oriented use cases. Subjects: Cryptography and Security (cs.CR) Cite as: arXiv:2608.11418 [cs.CR]   (or arXiv:2608.11418v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2608.11418 Focus to learn more Submission history From: Paul R. B. Houssel [view email] [v1] Tue, 11 Aug 2026 20:33:44 UTC (134 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-08 Change to browse by: cs References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)