Interacive Search of Complex Non-Indexed Data

这个项目的目标是实现和利用一个可以浏览计算机过去执行情况的系统。“浏览”是指用户搜索、分析、汇总、恢复或重放过去在其计算机上存在或发生的任意数据或事件的能力。这些功能依赖于两种基本技术。虚拟机自检允许系统在执行或重放时了解虚拟机的执行，而不会干扰执行或重放。虚拟机重放允许系统逐条指令地重新执行过去的时间间隔，但在时间和空间上只有几个百分比的开销。浏览计算机过去的执行的能力可以通过为管理员、用户和程序员提供新的能力而造福社会。管理员可以利用这种能力，通过检测过去的入侵来更有效地保护计算机，这可能有助于缩小由罪犯和垃圾邮件发送者控制的“机器人大军”的级别。失忆的老年人可以利用这一能力回忆起他们计算机上发生的事件，如电子邮件交流和图形用户界面交互。程序员可以使用这种能力来修复困难的非确定性错误，从而提高社会所依赖的软件的整体健壮性。

The goal of this project is to implement and leverage a system that canbrowse the past execution of a computer. "Browsing" refers to the abilityfor a user to search, analyze, summarize, restore, or replay arbitrary dataor events that existed or occurred sometime in the past on that user'scomputer. These capabilities depend on two foundational techniques.Virtual-machine introspection allows the system to understand the executionof a virtual machine as it executes or replays, without perturbing thatexecution or replay. Virtual-machine replay allows the system to re-executea past time interval of the virtual machine instruction-by-instruction, yetat only a few percentage overhead in time and space.The ability to browse the past execution of one's computer can benefitsociety by providing new capabilities to administrators, users, andprogrammers. Administrators can use this ability to secure computers moreeffectively by detecting past intrusions, which may help shrink the ranksof "bot armies" controlled by criminals and spammers. Elderly people withmemory loss can use this ability to recall the events that occurred ontheir computers, such as e-mail exchanges and GUI interactions. Programmerscan use this ability to fix difficult non-deterministic bugs and therebyimprove the overall robustness of the software on which society has come todepend.