ExecRecorder: VM-based full-system replay for attack analysis and system recovery

Log-based recovery and replay systems are important for system reliability, debugging and postmortem analysis/recovery of malware attacks. These systems must incur low space and performance overhead, provide full-system replay capabilities, and be resilient against attacks. Previous approaches fail to meet these requirements: they replay only a single process, or require changes in the host and guest OS, or do not have a fully-implemented replay component. This paper studies full-system replay for uniprocessors by logging and replaying architectural events. To limit the amount of logged information, we identify architectural nondeterministic events, and encode them compactly. Here we present ExecRecorder, a full-system, VM-based, log and replay framework for post-attack analysis and recovery. ExecRecorder can replay the execution of an entire system by checkpointing the system state and logging architectural nondeterministic events, and imposes low performance overhead (less than 4% o...

• Type: Conference
• Year: 2006
• Where: ASPLOS
• Authors: Daniela A. S. de Oliveira, Jedidiah R. Crandall, Gary Wassermann, Shyhtsun Felix Wu, Zhendong Su, Frederic T. Chong
• Keywords: Architectural Nondeterministic Events, ASPLOS 2006, Full-system Replay, Full-system Replay Capabilities, Programming Languages