Abstract

Understanding the dynamic aspects of the Linux kernel can help in a number of software engineering activities including maintenance and program comprehension, performance analysis, and most recently security.
Dynamic analysis of the Linux kernel is accomplished by instrumenting the kernel and studying the generated traces. However, the major concerns that developers face when using dynamic analysis tools are the large size of the generated traces, and the low-level nature of their events.
In this thesis, we apply pattern detection and utility removal techniques on low-level system call traces generated from the Linux kernel. As a result, we obtain high-level abstracted traces that are more compact and readable, while still preserving the system main behaviour.
We apply our techniques to five different systems running on the Linux kernel and assess the effectiveness of our approach in terms of quantity where we measure the compression ratio and in terms of quality where we study how the high-level abstractions can convey more meaningful information about the program being traced than low-level system call traces.