CAREER: System-Wide Intrusion Recovery Using Selective Re-execution

几乎任何计算机系统都可以被攻破。每天都会发现和利用新的软件漏洞，即使软件没有漏洞，不知不觉中的用户可能会安装恶意软件以及他们在线下载的免费屏幕保护程序或贺卡。在这些不可避免的妥协之后进行清理会导致用户或系统管理员花费数天的时间来浪费精力，而不能确定攻击的所有痕迹都会消失，或者不会丢失任何合法的更改。此研究项目通过开发系统范围的撤消机制来自动从入侵中恢复，以便管理员可以撤消攻击者的入侵尝试及其所有副作用，同时保留所有其他合法操作。其关键思想是记录所有计算，如进程或系统调用，以及它们之间的依赖关系，以便如果需要撤消某个操作，系统既可以撤消其直接影响，又可以递归跟踪并重新执行可能已受到间接影响的其他操作。在这一基本方法的基础上，该项目探讨了计算机系统必须如何改变，以安全和有效地提供系统范围的撤消，从操作系统内核到编程语言，再到应用程序和用户界面。如果成功，该项目将提供一种从计算机系统入侵中恢复的原则性方法。更广泛地说，系统范围的撤消在许多情况下可能会有所帮助，例如，用户意识到他们一周前更改了错误的设置，学生希望通过探索和撤消来学习新系统，或者应用程序开发人员希望试验大型系统。

Virtually any computer system can be compromised. New software vulnerabilities are discovered and exploited daily, and even if software were bug-free, unaware users may install malware along with free screensavers or greeting cards they download online. Cleaning up after these inevitable compromises leads to days of wasted effort by users or system administrators, with no conclusive guarantee that all traces of the attack are gone, or that no legitimate changes are lost.This research project automates recovery from intrusions by developing a system-wide undo mechanism, so that an administrator can undo an attacker's break-in attempt, along with all of its side-effects, while preserving all other legitimate operations. The key idea is to log all computations, such as processes or system calls, and the dependencies between them, so that if one operation needs to be undone, the system can both undo its direct effects, and recursively track down and re-execute other operations that may have been indirectly affected. Building on this basic approach, the project explores how computer systems must change to securely and efficiently provide system-wide undo, from operating system kernels, to programming languages, to applications and user interfaces.If successful, this project will provide a principled approach to recovering from intrusions in computer systems. More broadly, system-wide undo may help in many situations, such as users that realize they changed the wrong setting a week ago, students that want to learn a new system by exploring and undoing, or application developers that want to experiment with a large-scale system.