1. ReVirt: Enabling Intrusion Analysis Through Virtual-Machine Logging and Replay
By Dunlap, King, Cinar, Basrai, Chen
Presented by Seth Goldstein and Nathan Immerman
EECS 582 – W16

2. Outline Attacks Current Systems UMLinux Trusted Computing Base ReVirt
Evaluation
Conclusion

3. Attacks Use unintended consequences of non-deterministic events
Attempt to gain root access
Change code

4. Current Systems Security Completeness
Logs can be modified by a malicious kernel
Completeness
Don’t log external events

5. UMLinux OS-on-OS Diagram Using UMLinux
VMM loadable kernel module
OS-on-OS
Provides software analog for peripherals
OS-on-OS Diagram Using UMLinux

6. Trusted Computing Base (TCB)
Everything in a computing system that provides a secure environment
OS-on-OS
“The trusted computing base (TCB) of a computer system is the set of all hardware, firmware, and/or software components that are critical to its security, in the sense that bugs or vulnerabilities occurring inside the TCB might jeopardize the security properties of the entire system.” ~Wikipedia

7. ReVert: Details Deterministic and Non-Deterministic Events
Cooperative Logging
Analyzing Attacks

8. Deterministic / Non-Deterministic Events
Most normal instructions do not need to be logged
Non-Deterministic Events
Time (interrupts) and external input (ex. human input)
Only need to log events that affect actions of VM
Use “branch_retired” to monitor branching and interrupts

9. Cooperative Logging
One computers outgoing message is another computer’s incoming
Multiple computers can use ReVirt and perform a replay together

10. Analysis of Attacks Allows administrators to replay attacks
Run inside the guest OS
Debuggers and disk analyzer
Input packets from log

11. Evaluation
Virtualization Overhead
Correctness
Replay Overhead

12. Virtualization Overhead
Very little overhead added for computationally heavy tasks
High overhead for tasks that have a lot of kernel calls - more VMM involvement

13. Correctness
Saved register values and branch_retired to validate replay
Validates interprocess interaction and external inputs
It works.

14. Logging and Replay Overhead
Logging and replay time overhead manageable
Daily use - 0.2GB/day * 365 days/year = 73GB per year!

15. Conclusion
ReVirt successfully allows administrators to replay long-term instruction by instruction execution of a computer system

16. Discussion