CaTracer

Overview

CaTracer is the first component of CaT's pipeline, which is responsible for collecting I/O events information. It runs simultaneously with the targeted system, observing requests from the different components and storing them as events in a log file (CaTlog).

Components

Its design is composed of three main components:

• Collector: resorts to kernel-level tracing facilities for intercepting the context (e.g., type of event, timestamp, PID) and content (data buffers) of applications' requests.
• Handler: parses the collected information into events and saves them to a CATlog file.
• SigComp: generates signatures by computing hash sums of requests content.

Implementations

CaTracer has two different implementations:

• CatStrace: Strace-based tracer implemented in Python
• CatBpf: eBPF-based tracer implemented in GO