Availability-sensitive intrusion recovery
Shengzhi Zhang, Xi Xiong, Xiaoqi Jia, Peng Liu · 2009
A system-wide comprehensive cleaning is the primary goal of intrusion recovery. However, the diversity of the vulnerabilities, the creativity of the attackers and the complexity of system contribute to the difficulty of 'sweeping the footprint' of attacks. In this paper, we propose a VM-based intrusion recovery architecture with more concerns on service availability and continuity. Integrating the state of art techniques such as backtracking, cross-layer damage assessment and heterogeneous VM migration, our system can comprehensively sweep out the footprint of intrusion while providing desired service availability and continuity.