Efficiently tracking application interactions using lightweight virtualization

In this paper, we propose a general-purpose framework that harnesses the power of lightweight virtualization to track applications interactions in a scalable an efficient manner. Our goal is to use our framework for application auditing, intrusion detection, analysis, and system recovery from both malicious attacks and programmatic faults. In our framework, we construct each virtualized environment (VE) in a novel way that limits the scope and type of application events that need to be monitored. Our approach maintains the VE and system integrity, having as primarily focused on the interactions among VEs and system resources including the file system, memory, and network. Only events that are pertinent to the integrity of an application and its interactions with the operating system are recorded. We attempt to minimize the system overhead both in terms of system events we have to store and the resources required. Even though we cannot provide application replay, we keep enough informa...

• Type: Conference
• Year: 2008
• Where: CCS
• Authors: Yih Huang, Angelos Stavrou, Anup K. Ghosh, Sushil Jajodia
• Keywords: CCS 2008, General-purpose Framework, Lightweight Virtualization, Operating Systems, Security Privacy