Using virtual machines to do cross-layer damage assessment
Xiaoqi Jia, Shengzhi Zhang, Jiwu Jing, Peng Liu · 2008
In this paper, we present an approach that uses virtual machines to do ``out-of-the-box'' cross-layer damage assessment, an indispensable part of security/risk management. To resolve the conflict between fine-grained damage assessment and the response time requirements of service requests, we present a new production environment damage assessment architecture. We have implemented a major portion of the architecture and done preliminary evaluation. Contributions of our system include combining instruction and OS level taint tracking, and efficient ``what-if'' damage assessment methods.