Sciweavers

ASPLOS
2006
ACM

ExecRecorder: VM-based full-system replay for attack analysis and system recovery

13 years 9 months ago
ExecRecorder: VM-based full-system replay for attack analysis and system recovery
Log-based recovery and replay systems are important for system reliability, debugging and postmortem analysis/recovery of malware attacks. These systems must incur low space and performance overhead, provide full-system replay capabilities, and be resilient against attacks. Previous approaches fail to meet these requirements: they replay only a single process, or require changes in the host and guest OS, or do not have a fully-implemented replay component. This paper studies full-system replay for uniprocessors by logging and replaying architectural events. To limit the amount of logged information, we identify architectural nondeterministic events, and encode them compactly. Here we present ExecRecorder, a full-system, VM-based, log and replay framework for post-attack analysis and recovery. ExecRecorder can replay the execution of an entire system by checkpointing the system state and logging architectural nondeterministic events, and imposes low performance overhead (less than 4% o...
Daniela A. S. de Oliveira, Jedidiah R. Crandall, G
Added 13 Jun 2010
Updated 13 Jun 2010
Type Conference
Year 2006
Where ASPLOS
Authors Daniela A. S. de Oliveira, Jedidiah R. Crandall, Gary Wassermann, Shyhtsun Felix Wu, Zhendong Su, Frederic T. Chong
Comments (0)