NIGELOG: protecting logging information by hiding multiple backups in directories

Abstract

This paper proposes a novel method to protect logging information more securely. The method, named NIGELOG, produces multiple backups of the logging information, hides them in arbitrary directories, and periodically moves these backups to other directories. Also, NIGELOG can automatically restore the original logging information by using the backups even if the original file is altered or deleted by intruders. NIGELOG is implemented as a C++ class library with some standard software libraries and does not require additional hardware such as write-once media. It is easier to apply NIGELOG to UNIX applications which produces log-files.