Efficiently tracking application interactions using lightweight virtualization

  • Authors:

  • Yih Huang;Angelos Stavrou;Anup K. Ghosh;Sushil Jajodia

  • Affiliations:

  • George Mason University, Fairfax, VA, USA;George Mason University, Fairfax, VA, USA;George Mason University, Fairfax, VA, USA;George Mason University, Fairfax, VA, USA

  • Venue:
  • Proceedings of the 1st ACM workshop on Virtual machine security
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

In this paper, we propose a general-purpose framework that harnesses the power of lightweight virtualization to track applications interactions in a scalable an efficient manner. Our goal is to use our framework for application auditing, intrusion detection, analysis, and system recovery from both malicious attacks and programmatic faults. In our framework, we construct each virtualized environment (VE) in a novel way that limits the scope and type of application events that need to be monitored. Our approach maintains the VE and system integrity, having as primarily focused on the interactions among VEs and system resources including the file system, memory, and network. Only events that are pertinent to the integrity of an application and its interactions with the operating system are recorded. We attempt to minimize the system overhead both in terms of system events we have to store and the resources required. Even though we cannot provide application replay, we keep enough information for a wide range of other uses including system recovery and information tracking among others. As a proof of concept, we have implemented a prototype based on OpenVZ[35], a lightweight virtualization tool. Our preliminary results show that, compared to state-of-the-art event recording systems, we can reduce the amount of event recorded per application by almost an order of magnitude.