Can I read TimeVM: a framework for online intrusion mitigation and fast recovery using multi-time-lag traffic replay on EtoBox?

TimeVM: a framework for online intrusion mitigation and fast recovery using multi-time-lag traffic replay by Khalid Elbadawi; Ehab Al-Shaer is a scholarly article available to read on EtoBox.

What is TimeVM: a framework for online intrusion mitigation and fast recovery using multi-time-lag traffic replay about?

Network intrusions become a signification threat to network servers and its availability. A simple intrusion can suspend the organization's network services and can lead to a financial disaster. In this paper, we propose a framework called TimeVM to mitigate, or even eliminate, the infection of a network intrusion on-line as fast as possible. The framework is based on the virtual machine technology and trafficreplay-based recovery. TimeVM gives the illusion of "time machine". TimeVM logs only the network traffic to a server and replays the logged traffic to multiple "shadow" virtual machines (Shadow VM) after different time delays (time lags). Consequently, each Shadow VM will represent the server at different time in history. When attack/infection is detected, TimeVM enables navigating through the traffic history (logs), picking uninfected Shadow VM, removing the attack traffic, and then fast-replaying the entire traffic history to this Shadow VM. As a result, a typical up-to-date uninfected version of the original system can be constructed. The paper shows the implementation details for TimeVM. It also addresses many practical challenges related to how to configure and deploy Tim

Author

Khalid Elbadawi; Ehab Al-Shaer

Publisher

ACM

Published

2009

Language

EN