ReVirt: enabling intrusion analysis through virtual-machine logging and replay

By George W. Dunlap, Samuel T. King, S. Cinar, Murtaza A. Basrai, Peter M. Chen. USENIX Symposium on Operating Systems Design and Implementation, 2002

411 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems

View Paper: https://www.semanticscholar.org/paper/83d28e6bd4d9f2539f5b29e90e37b95987c6fba8

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

Citations in the corpus

Remus: High Availability via Asynchronous Virtual Machine Replication. (Best Paper) (2008, methodology): “Logging has also been used to build a time-travelling debugger [13] that, like ReVirt, replays the system for forensics only.”
RERAN: Timing- and touch-sensitive record and replay for Android (2013, background): “A substantial body of work has focused on deterministic replay by capturing and replaying events at the hardware [28], operating system [29], or virtual machine [30] levels.”
Secure and Flexible Monitoring of Virtual Machines (2007, methodology): “This technique has been used in a variety of research projects [21, 9, 10, 18, 7, 15, 2].”
Execution replay of multiprocessor virtual machines (2008, background): “For security, it allows a system administrator to go back and inspect the entire state of the system before, during, and after an attack, allowing the system administrator to determine how the attack took place and observe the attacker’s activities[6].”
Debugging Operating Systems with Time-Traveling Virtual Machines (Awarded General Track Best Paper Award!) (2005, methodology): “ReVirt used virtual-machine replay to enable detailed intrusion analysis [9].”
Lares: An Architecture for Secure Active Monitoring Using Virtualization (2008, methodology): “Dunlap et al. actively logs all I/O activity of a VM to enable VM backtracking and replay functionality, which can be used to analyze attacks [ 6 ].”
Xen and the art of virtualization (2003, methodology): “In this paper we present Xen, a high performance resource-managed virtual machine monitor (VMM) which enables applications such as server consolidation [41, 8], co-located hosting facilities [14], distributed web services [42], secure computing platforms [12, 16] and application mobility [25, 36].”
Finding and Reproducing Heisenbugs in Concurrent Programs (2008, positive): “As has been amply demonstrated in previous work [13, 23, 27, 4], perfect replay is impossible without signiﬁcant engineering and heavy-weight techniques that capture all sources of non-determinism.”
A Virtual Honeypot Framework (2004, methodology): “A high-interaction honeypot like ReVirt [7] is used to detect compromises or unusual network activity.”
SubVirt: implementing malware with virtual machines (2006, background): “Researchers have used virtual machines to detect intrusions [18] [8] [27], isolate services [33], encrypt network traffic [33], analyze intrusions [14], and implement honeypots [26] [46].”
NOVA: a microhypervisor-based secure virtualization architecture (2010, background): “Virtualization can also be used to replay [10], debug [16], and live-migrate [9] operating systems.”
Countering code-injection attacks with instruction-set randomization (2003, background): “Emulator-based approaches have also been proposed in the context of intrusion and anomaly detection [25, 32], as well as one way to retain backward compatibility with older processors(2) — often exhibiting better performance.”
Rx: treating bugs as allergies---a safe method to survive software failures (2005, background): “In some cases, great care is taken to ensure deterministic replay [23, 46, 25].”
A survey of microarchitectural timing attacks and countermeasures on contemporary hardware (2016, methodology): “[49] proposed this as a debugging technique, and it was later incorporated into Determinator [22].”
Terra: a virtual machine-based platform for trusted computing (2003, background): “This can be used to harden a variety of host security mechanisms against attack, such as key stores, intrusion detection systems [27], secure logging systems [21], and virus scanners [4].”