ExecRecorder: VM-based full-system replay for attack analysis and system recovery

  • Authors:

  • Daniela A. S. de Oliveira;Jedidiah R. Crandall;Gary Wassermann;S. Felix Wu;Zhendong Su;Frederic T. Chong

  • Affiliations:

  • University of California at Davis, Santa Barbara;University of California at Davis, Santa Barbara;University of California at Davis, Santa Barbara;University of California at Davis, Santa Barbara;University of California at Davis, Santa Barbara;University of California at Davis, Santa Barbara

  • Venue:
  • Proceedings of the 1st workshop on Architectural and system support for improving software dependability
  • Year:
  • 2006

Quantified Score

Hi-index 0.00

Visualization

Abstract

Log-based recovery and replay systems are important for system reliability, debugging and postmortem analysis/recovery of malware attacks. These systems must incur low space and performance overhead, provide full-system replay capabilities, and be resilient against attacks. Previous approaches fail to meet these requirements: they replay only a single process, or require changes in the host and guest OS, or do not have a fully-implemented replay component. This paper studies full-system replay for uniprocessors by logging and replaying architectural events. To limit the amount of logged information, we identify architectural nondeterministic events, and encode them compactly. Here we present ExecRecorder, a full-system, VM-based, log and replay framework for post-attack analysis and recovery. ExecRecorder can replay the execution of an entire system by checkpointing the system state and logging architectural nondeterministic events, and imposes low performance overhead (less than 4% on average). In our evaluation its log files grow at about 5.4 GB/hour (arithmetic mean). Thus it is practical to log on the order of hours or days between checkpoints. It can also be integrated naturally with an IDS and a post-attack analysis tool for intrusion analysis and recovery.