ReVirt: Enabling intrusion analysis through virtual-machine logging and replay

被引：237

作者：

Dunlap, GW ^{[1
]}

King, ST ^{[1
]}

Cinar, S ^{[1
]}

Basrai, MA ^{[1
]}

Chen, PM ^{[1
]}

机构：

[1] Univ Michigan, Dept Elect Engn & Comp Sci, Ann Arbor, MI 48109 USA

来源：

USENIX ASSOCIATION PROCEEDINGS OF THE FIFTH SYMPOSIUM ON OPERATING SYSTEMS DESIGN AND IMPLEMENTATION | 2002年

关键词：

D O I：

10.1145/1060289.1060309

中图分类号：

TP3 [计算技术、计算机技术];

学科分类号：

0812 ;

摘要：

Current system loggers have two problems: they depend on the integrity of the operating system being logged, and they do not save sufficient information to replay and analyze attacks that include any non-deterministic events. ReVirt removes the dependency on the target operating system by moving it into a virtual machine and logging below the virtual machine. This allows ReVirt to replay the system's execution before, during, and after an intruder compromises the system, even if the intruder replaces the target operating system. ReVirt logs enough information to replay a long-term execution of the virtual machine instruction-by-instruction. This enables it to provide arbitrarily detailed observations about what transpired on the system, even in the presence of non-deterministic attacks and executions. ReVirt adds reasonable time and space overhead. Overheads due to virtualization are imperceptible for interactive use and CPU-bound workloads, and 13-58% for kernel-intensive workloads. Logging adds 0-8% overhead, and logging traffic for our workloads can be stored on a single disk for several months.

引用

页码：211 / 224

页数：14

共 26 条

[1] Anderson J.P., 1980, Computer security threat monitoring and surveillance
[2] [Anonymous], IEEE COMPUT
[3] ASHCRAFT K, 2002, P 2002 IEEE S SEC PR
[4] BELLINO J, 1973, P 1973 ACM WORKSH VI, P20
[5] Bishop M, 1996, COMPUT SYST, V9, P131
[6] Hypevisor-based fault-tolerance
Bressoud, TC
Schneider, FB
[J]. ACM TRANSACTIONS ON COMPUTER SYSTEMS, 1996, 14 (01): : 80 - 107
[7] Framework for testing the fault-tolerance of systems including OS and network aspects
Buchacker, K
Sieh, V
[J]. SIXTH IEEE INTERNATIONAL SYMPOSIUM ON HIGH ASSURANCE SYSTEMS ENGINEERING, 2001, : 95 - 105
[8] Chen PM, 2001, EIGHTH WORKSHOP ON HOT TOPICS IN OPERATING SYSTEMS, PROCEEDINGS, P133
[9] DIKE J, 2000, P 2000 LIN SHOWC C O
[10] A survey of rollback-recovery protocols in message-passing systems
Elnozahy, EN
Alvisi, L
Wang, YM
Johnson, DB
[J]. ACM COMPUTING SURVEYS, 2002, 34 (03) : 375 - 408

← 1 2 3 →