ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay

ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay (2002)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by George W. Dunlap , Samuel T. King , Sukru Cinar , Murtaza A. Basrai , Peter M. Chen

Venue:	In Proceedings of the 2002 Symposium on Operating Systems Design and Implementation (OSDI
Citations:	277 - 18 self

Versions

Version History

Metadata Version 1

Datum	Value	Source
TITLE	ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay	INFERENCE
AUTHOR NAME	George W. Dunlap	SVM HeaderParse 0.2
AUTHOR AFFIL	Department of Electrical Engineering and Computer Science; University of Michigan	SVM HeaderParse 0.2
AUTHOR NAME	Samuel T. King	SVM HeaderParse 0.2
AUTHOR AFFIL	Department of Electrical Engineering and Computer Science; University of Michigan	SVM HeaderParse 0.2
AUTHOR NAME	Sukru Cinar	SVM HeaderParse 0.2
AUTHOR AFFIL	Department of Electrical Engineering and Computer Science; University of Michigan	SVM HeaderParse 0.2
AUTHOR NAME	Murtaza A. Basrai	SVM HeaderParse 0.2
AUTHOR AFFIL	Department of Electrical Engineering and Computer Science; University of Michigan	SVM HeaderParse 0.2
AUTHOR NAME	Peter M. Chen	SVM HeaderParse 0.2
AUTHOR AFFIL	Department of Electrical Engineering and Computer Science; University of Michigan	SVM HeaderParse 0.2
ABSTRACT	Rights to individual papers remain with the author or the author's employer. Permission is granted for noncommercial reproduction of the work for educational or research purposes. This copyright notice must be included in the reproduced paper. USENIX acknowledges all trademarks herein. Current system loggers have two problems: they depend on the integrity of the operating system being logged, and they do not save sufficient information to replay and analyze attacks that include any non-deterministic events. ReVirt removes the dependency on the target operating system by moving it into a virtual machine and logging below the virtual machine. This allows ReVirt to replay the system’s execution before, during, and after an intruder compromises the system, even if the intruder replaces the target operating system. ReVirt logs enough information to replay a long-term execution of the virtual machine instruction-by-instruction. This enables it to provide arbitrarily detailed observations about what transpired on the system, even in the presence of non-deterministic attacks and executions. ReVirt adds reasonable time and space overhead. Overheads due to virtualization are imperceptible for interactive use and CPU-bound workloads, and 13-58 % for kernel-intensive workloads. Logging adds 0-8 % overhead, and logging	SVM HeaderParse 0.2
YEAR	2002	SVM HeaderParse 0.2
VENUE	In Proceedings of the 2002 Symposium on Operating Systems Design and Implementation (OSDI	INFERENCE
VENUE TYPE	CONFERENCE	INFERENCE
PAGES	211--224	INFERENCE
VOLUME	36	INFERENCE
CITATIONS	20 found	ParsCit 1.0