Cross-layer comprehensive intrusion harm analysis for production workload server systems

Shengzhi Zhang, Xiaoqi Jia, Peng Liu, Jiwu Jing

Research output: Chapter in Book/Report/Conference proceedingConference contribution

7 Scopus citations

Abstract

Analyzing the (harm of) intrusion to enterprise servers is an onerous and error-prone work. Though dynamic taint tracking enables automatic fine-grained intrusion harm analysis for enterprise servers, the significant runtime overhead introduced is generally intolerable in the production workload environment. Thus, we propose PEDA (Production Environment Damage Analysis) system, which decouples the onerous analysis work from the online execution of the production servers. Once compromised, the "has-been-infected" execution is analyzed during high fidelity replay on a separate instrumentation platform. The replay is implemented based on the heterogeneous virtual machine migration. The servers' online execution runs atop fast hardware-assisted virtual machines (such as Xen for near native speed), while the infected execution is replayed atop binary instrumentation virtual machines (such as Qemu for the implementation of taint analysis). From identified intrusion symptoms, PEDA is capable of locating the fine-grained taint seed by integrating the backward system call dependency tracking and one-step-forward taint information flow auditing. Started with the fine-grained taint seed, PEDA applies dynamic taint analysis during the replayed execution. Evaluation demonstrates the efficiency of PEDA system with runtime overhead as low as 5%. The real-life intrusion studies successfully show the comprehensiveness and the precision of PEDA's intrusion harm analysis.

Original languageEnglish (US)
Title of host publicationProceedings - 26th Annual Computer Security Applications Conference, ACSAC 2010
Pages297-306
Number of pages10
DOIs
StatePublished - Dec 1 2010
Event26th Annual Computer Security Applications Conference, ACSAC 2010 - Austin, TX, United States
Duration: Dec 6 2010Dec 10 2010

Publication series

NameProceedings - Annual Computer Security Applications Conference, ACSAC
ISSN (Print)1063-9527

Other

Other26th Annual Computer Security Applications Conference, ACSAC 2010
CountryUnited States
CityAustin, TX
Period12/6/1012/10/10

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications
  • Software
  • Safety, Risk, Reliability and Quality

Fingerprint Dive into the research topics of 'Cross-layer comprehensive intrusion harm analysis for production workload server systems'. Together they form a unique fingerprint.

  • Cite this

    Zhang, S., Jia, X., Liu, P., & Jing, J. (2010). Cross-layer comprehensive intrusion harm analysis for production workload server systems. In Proceedings - 26th Annual Computer Security Applications Conference, ACSAC 2010 (pp. 297-306). (Proceedings - Annual Computer Security Applications Conference, ACSAC). https://doi.org/10.1145/1920261.1920306