Bezoar: Automated virtual machine-based full-system recovery from control-flow hijacking attacks

Daniela A.S. De Oliveira, Jedidiah R. Crandall, Gary Wassermann, Shaozhi Ye, S. Felix Wu, Zhendong Su, Frederic T. Chong

Research output: Chapter in Book/Report/Conference proceedingConference contribution

6 Scopus citations

Abstract

System availability is difficult for systems to maintain in the face of Internet worms. Large systems have vulnerabilities, and if a system attempts to continue operation after an attack, it may not behave properly. Traditional mechanisms for detecting attacks disrupt service and current recovery approaches are application-based and cannot guarantee recovery in the face of exploits that corrupt the kernel, involve multiple processes or target multithreaded network services. This paper presents Bezoar, an automated full-system virtual machine-based approach to recover from zero-day control-flow hijacking attacks. Bezoar tracks down the source of network bytes in the system and after an attack, replays the checkpointed run while ignoring inputs from the malicious source. We evaluated our proof-of-concept prototype on six notorious exploits for Linux and Windows. In all cases, it recovered the full system state and resumed execution. Bezoar incurs low overhead to the virtual machine: less than 1% for the recovery and log components and approximately 1.4X for the memory monitor component that tracks down network bytes, for five SPEC INT 2000 benchmarks.

Original languageEnglish (US)
Title of host publicationNOMS 2008 - IEEE/IFIP Network Operations and Management Symposium
Subtitle of host publicationPervasive Management for Ubiquitous Networks and Services
Pages121-128
Number of pages8
DOIs
StatePublished - 2008
Externally publishedYes
EventNOMS 2008 - IEEE/IFIP Network Operations and Management Symposium: Pervasive Management for Ubiquitous Networks and Services - Salvador - Bahia, Brazil
Duration: Apr 7 2008Apr 11 2008

Publication series

NameNOMS 2008 - IEEE/IFIP Network Operations and Management Symposium: Pervasive Management for Ubiquitous Networks and Services

Conference

ConferenceNOMS 2008 - IEEE/IFIP Network Operations and Management Symposium: Pervasive Management for Ubiquitous Networks and Services
CountryBrazil
CitySalvador - Bahia
Period4/7/084/11/08

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Information Systems

Fingerprint Dive into the research topics of 'Bezoar: Automated virtual machine-based full-system recovery from control-flow hijacking attacks'. Together they form a unique fingerprint.

Cite this