System-Level Support for Intrusion Recovery
System-Level Support for Intrusion Recovery
复制标题
DOI：
10.1007/978-3-642-37300-8_9
复制
发表时间：
2012-07
期刊：
影响因子：
--
通讯作者：
Andrei Bacs;Remco Vermeulen;Asia Slowinska;H. Bos
中科院分区：
文献类型：
--
作者：
Andrei Bacs;Remco Vermeulen;Asia Slowinska;H. Bos
从攻击中恢复是很困难的，而且随着初始感染和检测之间的时间增加而变得更加困难。攻击者修改了哪些文件？是否有任何用户数据依赖于恶意输入？我还能信任我自己的文档或二进制文件吗？当恶意代码已经活跃了一段时间，并且它的行为与良性应用程序的行为混合在一起时，这些问题在当前系统上是不可能回答的。在本文中，我们描述了一个攻击分析和恢复系统，能够从复杂的攻击中恢复半自动化的方式。在修改后的QEMU版本中，Duster可以在内存和磁盘上以字节级的粒度跟踪恶意代码。通过使用污点分析，SearchDuster还可以跟踪恶意代码写入的所有字节，以提供有关哪些文件（中的字节）源自恶意数据的详细视图。接下来，它使用此信息在恢复时删除恶意操作。
Recovering from attacks is hard and gets harder as the time between the initial infection and its detection increases. Which files did the attackers modify? Did any of user data depend on malicious inputs? Can I still trust my own documents or binaries? When malcode has been active for some time and its actions are mixed with those of benign applications, these questions are impossible to answer on current systems. In this paper, we describe DiskDuster, an attack analysis and recovery system capable of recovering from complicated attacks in a semi-automated manner. DiskDuster traces malcode at byte-level granularity both in memory and on disk in a modified version of QEMU. Using taint analysis, DiskDuster also tracks all bytes written by the malcode, to provide a detailed view on what (bytes in) files derive from malicious data. Next, it uses this information to remove malicious actions at recovery time.