1 Hit in 0.042 sec

SHELF: Preserving Business Continuity and Availability in an Intrusion Recovery System

Xi Xiong, Xiaoqi Jia, Peng Liu
2009 2009 Annual Computer Security Applications Conference  
Recovering from intrusions for a compromised computer system is a challenging job, especially for systems that run continuous services. Current intrusion recovery techniques often do not preserve the accumulated useful state of running applications and have very limited system availability when performing recovery routines. In this paper, we propose SHELF, an on-the-fly intrusion recovery prototype system that provides a comprehensive solution to preserve business continuity, availability and
more » ... availability and recovery accuracy. SHELF preserves accumulated clean states for infected applications and files so that they can continue with the most recent pre-infection states after recovery. Moreover, SHELF leverages OS-aware taint tracking techniques to swiftly determine the sources of intrusion and assess system-wide damages caused by the intrusion. SHELF uses quarantine methods to prevent infection propagation so that uninfected and recovered objects can provide availability during the recovery phase. We integrate SHELF prototype in a virtualization environment to achieve user transparency and protection. Our evaluation shows that SHELF can perform accurate recovery on-the-fly effectively with an acceptable performance overhead.
doi:10.1109/acsac.2009.52 dblp:conf/acsac/XiongJL09 fatcat:sms5irelbvgqpfehtar4bah5vq