TimeVM: A framework for online intrusion mitigation and fast recovery using multi-time-lag traffic replay

Proceedings of the 4th International Symposium on ACM Symposium on Information, Computer and Communications Security, ASIACCS'09

Volumn , Issue , 2009, Pages 135-145

  Elbadawi, Khalid ^a   Al Shaer, Ehab ^a  

^a DEPAUL UNIVERSITY   (United States)

Author keywords

Intrusion; Mitigation; Recovery; Replay; Traffic replay; Virtual machine

Indexed keywords

ATTACK TRAFFIC; FAST RECOVERY; MITIGATION; NETWORK INTRUSIONS; NETWORK SERVER; NETWORK SERVICES; NETWORK TRAFFIC; ORIGINAL SYSTEMS; RECOVERY TIME; TIME LAG; TIME MACHINE; VIRTUAL MACHINE TECHNOLOGY; VIRTUAL MACHINES;

COMPUTER SYSTEM RECOVERY; METAL RECOVERY; SERVERS;

SECURITY OF DATA;

EID: 77952365722     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1533057.1533077     Document Type: Conference Paper

References (21)

1. http://www.rtfm.com/ssldump.
2. T. F. Abdelzaher and C. Lu. Modeling and performance control of internet servers. In Proceedings of the 39th IEEE Conference on Decision and Control, volume 3, pages 2234-2239, 2000.
3. P. Barham, B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, R. Neugebauer, I. Pratt, and A. Warfield. Xen and the art of virtualization. In SOSP '03: Proceedings of the nineteenth ACM symposium on Operating systems principles, pages 164-177, 2003.
4. A. Cichocki and R. Unbehauen. Neural Networks for Optimization and Signal Processing. John Wiley and Sons, 1993.
5. J. R. Crandall and T. F. Chong. Minos: Control data attack preventing orthogonal to memory model. In In Proceedings of the 37th International Symposium on Microarchitecture (MICRO), 2004.
6. J. R. Crandall, Z. Su, S. F. Wu, and T. F. Chong. On deriving unkown vulnerabilities from zero-day polymorphic and metamorphic worm exploits. ACM CCS, pages 235-248, 2005.
7. D. A. S. de Oliveira, J. R. Crandall, G. Wassermann, S. F. Wu, Z. Su, and F. T. Chong. Execrecorder: Vm-based full-system replay for attack analysis and system recovery. In ASID '06: Proceedings of the 1st workshop on Architectural and system support for improving software dependability, pages 66-71, 2006.
8. G. W. Dunlap, S. T. King, S. Cinar, M. A. Basrai, and P. M. Chen. Revirt: enabling intrusion analysis through virtual-machine logging and replay. SIGOPS Oper. Syst. Rev., 36:211-224, 2002.
9. G. W. Dunlap, D. G. Lucchetti, M. A. Fetterman, and P. M. Chen. Execution replay of multiprocessor virtual machines. In VEE '08: Proceedings of the fourth ACM SIGPLAN/SIGOPS international conference on Virtual execution environments, pages 121-130, 2008.
10. M. Kharbutli, X. Jiang, Y. Solihin, G. Venkataramani, and M. Prvulovic. Comprehensively and efficiently protecting the heap. ASPLOC, 2006.
11. T. J. LeBlanc and J. M. Mellor-Crummey. Debugging parallel programs with instant replay. IEEE Trans. Comput., 36 (4):471-482, 1987.
12. J. D. C. Little. A proof of the queueing formula I = Γw. Oper. Res., p:383-387, 1961.
13. M. V. Mahoney. Network traffic anomaly detection based on packet bytes. In SAC '03: Proceedings of the 2003 ACM symposium on Applied computing, pages 346-350, 2003.
14. L. McVoy and C. Staelin. lmbench: Portable tools for performance analysis. In Proceedings of the USENIX, 1996.
15. S. Narayanasamy, G. Pokam, and B. Calder. Bugnet: Continuously recording program execution for deterministic replay debugging. SIGARCH Comput. Archit. News, 33 (2):284-295, 2005.
16. I. Ray and S. Tideman. A secure tcp connection migration protocol to enable the survivability of client-server applications under malicious attack. J. Netw. Syst. Manage., 12 (2):251-276, 2004.
17. A. C. Snoeren, D. G. Andersen, and H. Balakrishnan. Fine-grained failover using connection migration. In USITS'01: Proceedings of the 3rd conference on USENIX Symposium on Internet Technologies and Systems, 2001.
18. S. M. Srinivasan, S. Kandula, C. R. Andrews, and Y. Zhou. Flashback: a lightweight extension for rollback and deterministic replay for software debugging. In ATEC '04: Proceedings of the annual conference on USENIX Annual Technical Conference, pages 3-3, 2004.
19. F. Sultan, K. Srinivasan, and L. Iftode. Migratory tcp: connection migration for service continuity in the internet. In Proceedings of the 22nd International Conference on Distributed Computing Systems, pages 469-470, 2002.
20. A. Whitaker, R. S. Cox, M. Shaw, and S. D. Gribble. Rethinking the design of virtual machine monitors. IEEE Computer, 38 (5):57-62, 2005.
21. M. Xu, R. Bodik, and M. D. Hill. A flight data recorder for enabling full-system multiprocessor deterministic replay. SIGARCH Comput. Archit. News, 31 (2):122-135, 2003.