HyperAudit: Towards User Transparent and Highly Efficient System Auditing for Cloud Platforms

System auditing is a critical security primitive for cloud platforms, but existing auditing frameworks place the log collection module inside the compromise-prone guest kernel. This design exposes a large attack surface and enables race condition attacks, where an attacker that compromises the kernel can tamper with uncommitted logs and erase pre-compromise traces. Prior secure collectors mitigate this by frequent synchronous or timed submissions, which incur non-trivial runtime overhead. We present HyperAudit, a hypervisor-assisted auditing architecture that isolates the log collection module from the guest kernel while keeping collection efficient and deployable. HyperAudit injects a kernel-independent collector into a hidden memory region, protects its code with execute-only permissions, and shields the log buffer with guard-page trapping, minimizing the exposed attack surface. Logs are asynchronously pulled by a consumer in a dedicated Secure VM, avoiding periodic synchronous commits. Under the common auditing assumption that logs generated after kernel compromise are untrustworthy, HyperAudit guarantees the integrity of all pre-compromise logs against race condition and flooding attacks. We implement HyperAudit on both x86 and Arm without extra hardware, and show that it reduces log-intensive application overhead by 49% and 66% compared to eAudit and HitchHiker, even outperforming host-only collectors.