Detecting past and present intrusions through vulnerability-specific predicates

Proceedings of the 20th ACM Symposium on Operating Systems Principles, SOSP 2005

Volumn , Issue , 2005, Pages 91-104

  Joshi, Ashlesha ^a   King, Samuel T ^a   Dunlap, George W ^a   Chen, Peter M ^a  

^a UNIVERSITY OF MICHIGAN   (United States)

Author keywords

IntroVirt; intrusion detection; semantic gap; virtual machine introspection; virtual machine replay; vulnerability specific predicates

Indexed keywords

INTROVIRT; SEMANTIC GAP; VIRTUAL-MACHINE INTROSPECTION; VIRTUAL-MACHINE REPLAY; VULNERABILITY-SPECIFIC PREDICATES;

INTRUSION DETECTION; SEMANTICS;

SOFTWARE TESTING;

EID: 84885639914     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1095810.1095820     Document Type: Conference Paper

References (33)

1. J. Allen, A. Christie, W. Fithen, J. McHugh, J. Pickel, and E. Stoner. State of the Practice of Intrusion Detection Technologies. Technical Report CMU/SEI-99-TR-028, Carnegie Mellon University, 1999.
2. W. A. Arbaugh, W. L. Fithen, and J. McHugh. Windows of Vulnerability: A Case Study Analysis. IEEE Computer, 33(12):52-59, December 2000.
3. P. Barham, B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, R. Neugebauer, I. Pratt, and A. Warfield. Xen and the Art of Virtualization. In Proceedings of the 2003 Symposium on Operating Systems Principles, October 2003.
4. S. Beattie, S. Arnold, C. Cowan, P. Wagle, C.Wright, and A. Shostack. Timing the Application of Security Patches for Optimal Uptime. In Proceedings of the 2002 USENIX Systems Administration Conference (LISA), November 2002.
5. T. C. Bressoud and F. B. Schneider. Hypervisor-based fault tolerance. ACM Transactions on Computer Systems, 14(1):80-107, February 1996.
6. A. B. Brown and D. A. Patterson. Undo for Operators: Building an Undoable E-mail Store. In Proceedings of the 2003 USENIX Technical Conference, June 2003.
7. H. K. Browne, W. A. Arbaugh, J. McHugh, and W. L. Fithen. A Trend Analysis of Exploitations. In Proceedings of the 2001 IEEE Symposium on Security and Privacy, May 2001.
8. M. Costa, July 2005. personal communication.
9. M. Costa, J. Crowcroft, M. Castro, A. Rowstron, L. Zhou, L. Zhang, and P. Barham. Vigilante: End-to-End Containment of Internet Worms. In Proceedings of the 2005 Symposium on Operating Systems Principles, October 2005.
10. D. Dean and A. J. Hu. Fixing Races for Fun and Profit: How to use access(2). In Proceedings of the 2004 USENIX Security Symposium, pages 195-206, August 2004.
11. J. Dike. A user-mode port of the Linux kernel. In Proceedings of the 2000 Linux Showcase and Conference, October 2000.
12. G. W. Dunlap. Execution Replay for Intrusion Analysis. Technical report, University of Michigan, January 2005. PhD thesis proposal.
13. G. W. Dunlap, S. T. King, S. Cinar, M. Basrai, and P. M. Chen. ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay. In Proceedings of the 2002 Symposium on Operating Systems Design and Implementation (OSDI), pages 211-224, December 2002.
14. T. Garfinkel, B. Pfaff, J. Chow, M. Rosenblum, and D. Boneh. Terra: A Virtual Machine-Based Platform for Trusted Computing. In Proceedings of the 2003 Symposium on Operating Systems Principles, October 2003.
15. T. Garfinkel and M. Rosenblum. A Virtual Machine Introspection Based Architecture for Intrusion Detection. In Proceedings of the 2003 Network and Distributed System Security Symposium (NDSS), February 2003.
16. M. Hicks, J. T. Moore, and S. Nettles. Dynamic Software Updating. In Proceedings of the 2001 Conference on Programming Language Design and Implementation (PLDI), June 2001.
17. S. T. King, G. W. Dunlap, and P. M. Chen. Debugging operating systems with time-traveling virtual machines. In Proceedings of the 2005 USENIX Technical Conference, April 2005.
18. K. Lhee and S. J. Chapin. Detection of file-based race conditions. International Journal of Information Security, pages 105-119, February 2005. (Pubitemid 40347204)
19. P. S. Magnusson, M. Christensson, J. Eskilson, D. Forsgren, G. Hallberg, J. Hogberg, F. Larsson, A. Moestedt, and B. Werner. Simics: A Full System Simulation Platform. IEEE Computer, 35(2):50-58, February 2002.
20. D. Mazieres and M. F. Kaashoek. Secure applications need flexible operating systems. In Proceedings of the 1997 Workshop on Hot Topics in Operating Systems (HotOS), pages 56-61, May 1997.
21. R. Meushaw and D. Simard. NetTop: Commercial Technology in High Assurance Applications. Tech Trend Notes: Preview of Tomorrow's Information Technologies, 9(4), September 2000.
22. E. Rescorla. Security Holes...Who Cares? In Proceedings of the 2002 USENIX Security Symposium, August 2003.
23. R. Rodrigues, M. Castro, and B. Liskov. BASE: Using Abstraction to Improve Fault Tolerance. In Proceedings of the 2001 Symposium on Operating Systems Principles, October 2001.
24. M. Rosenblum, E. Bugnion, S. Devine, and S. Herrod. Using the SimOS Machine Simulator to Study Complex Computer Systems. ACM Transactions on Modeling and Computer Simulation, 7(1):78-103, January 1997.
25. M. I. Seltzer, Y. Endo, C. Small, and K. A. Smith. Dealing With Disaster: Surviving Misbehaving Kernel Extensions. In Proceedings of the 1996 Symposium on Operating Systems Design and Implementation (OSDI), October 1996.
26. A. Somayaji and S. Forrest. Automated response using system-call delays. In Proceedings of the 2000 USENIX Security Symposium, August 2000.
27. C. A. N. Soules, J. Appavoo, K. Hui, R. W. Wisniewski, D. D. Silva, G. R. Ganger, O. Krieger, M. Stumm, M. Auslander, M. Ostrowski, B. Rosenburg, and J. Xenidis. System Support for Online Reconfiguration. In Proceedings of the 2003 USENIX Technical Conference, June 2003.
28. A. Tamches and B. P. Miller. Fine-Grained Dynamic Instrumentation of Commodity Operating System Kernels. In Proceedings of the 1999 Symposium on Operating Systems Design and Implementation (OSDI), February 1999.
29. R. Uhlig, G. Neiger, D. Rodgers, A. L. Santoni, F. C. M. Martins, A. V. Anderson, S. M. Bennett, A. Kagi, F. H. Leung, and L. Smith. Intel Virtualization Technology. IEEE Computer, 38(5):48-56, May 2005. (Pubitemid 40784342)
30. H. J.Wang, C. Guo, D. R. Simon, and A. Zugenmaier. Shield: Vulnerability-Driven Network Filters for Preventing Known Vulnerability Exploits. In Proceedings of the 2004 ACM SIGCOMM Conference, August 2004.
31. A.Whitaker, R. Cox, M. Shaw, and S. D. Gribble. Constructing Services With Interposable Virtual Hardware. In Proceedings of the 2004 Symposium on Network System Design and Implementation (NSDI), March 2004.
32. A. Whitaker, R. S. Cox, and S. D. Gribble. Configuration Debugging as Search: Finding the Needle in the Haystack. In Proceedings of the 2004 Symposium on Operating Systems Design and Implementation (OSDI), December 2004.
33. M. Xu, R. Bodik, and M. D. Hill. A "Flight Data Recorder" for Enabling Full-system Multiprocessor Deterministic Replay. In Proceedings of the 2003 International Symposium on Computer Architecture, June 2003.