Nodrop Overview

Nodrop is a provenance collector which addresses the “data integrity vs. efficiency dilemma” without introducing significant extra overhead. It efficiently isolates resources for provenance data handling by enforcing processes to consume their own resource quota to handle the provenance data generated by themselves. NoDrop is inspired by the idea of threadlet. Instead of having independent threads to process system call events, NoDrop leverages the capability of other running threads. It dynamically instruments the processing logic to the memory of a running thread.