상세정보
학술대회
Real-time Multi-process Tracing Decoder Architecture
- 발행일
- 201906
- 출처
- Workshop on Systems and Network Telemetry and Analytics (SNTA) 2019, pp.49-52
- 협약과제
- 19HH3700, 맞춤형 보안서비스 제공을 위한 클라우드 기반 지능형 보안 기술 개발, 김종현
- 초록
- Tracing is a form of logging by recording the execution information of programs. Since a large amount of data must be created and decoded in real time, a tracer composed mainly of dedicated hardware is widely used. Intel짰 PT records all information related to software execution from each hardware thread. When the execution of the corresponding software is completed, the accurate program flow can be indicated through the recorded trace data. The hardware trace program can be integrated into the operating system, but in the case of the Windows system, the kernel is not disclosed so tight integration is not achieved. Also, in a Windows environment, it can only trace a single process and do not provide a way to trace multiple process streams. In this paper, we propose a way of extending the PT trace program in order to overcome this shortcoming by supporting multi-process stream tracing in Windows environment.
- KSP 제안 키워드
- Multi-process, Program flow, Real-Time, Tight integration, decoder architecture, dedicated hardware, operating system, trace data