Retroactive auditing

Retroactive auditing is a new approach for detecting past intrusions and vulnerability exploits based on security patches. It works by spawning two copies of the code that was patched, one with and one without the patch, and running both of them on the same inputs observed during the system's o...

Full description

Bibliographic Details
Main Authors: Wang, Xi (Contributor), Zeldovich, Nickolai (Contributor), Kaashoek, M. Frans (Contributor)
Other Authors: Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory (Contributor), Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science (Contributor)
Format: Article
Language:English
Published: Association for Computing Machinery (ACM), 2012-08-15T18:29:20Z.
Subjects:
Online Access:Get fulltext
LEADER 01723 am a22002653u 4500
001 72155
042 |a dc 
100 1 0 |a Wang, Xi  |e author 
100 1 0 |a Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory  |e contributor 
100 1 0 |a Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science  |e contributor 
100 1 0 |a Kaashoek, M. Frans  |e contributor 
100 1 0 |a Wang, Xi  |e contributor 
100 1 0 |a Zeldovich, Nickolai  |e contributor 
100 1 0 |a Kaashoek, M. Frans  |e contributor 
700 1 0 |a Zeldovich, Nickolai  |e author 
700 1 0 |a Kaashoek, M. Frans  |e author 
245 0 0 |a Retroactive auditing 
260 |b Association for Computing Machinery (ACM),   |c 2012-08-15T18:29:20Z. 
856 |z Get fulltext  |u http://hdl.handle.net/1721.1/72155 
520 |a Retroactive auditing is a new approach for detecting past intrusions and vulnerability exploits based on security patches. It works by spawning two copies of the code that was patched, one with and one without the patch, and running both of them on the same inputs observed during the system's original execution. If the resulting outputs differ, an alarm is raised, since the input may have triggered the patched vulnerability. Unlike prior tools, retroactive auditing does not require developers to write predicates for each vulnerability. 
520 |a United States. Defense Advanced Research Projects Agency. Clean-slate design of Resilient, Adaptive, Secure Hosts (Contract number N66001-10-2-4089) 
520 |a National Natural Science Foundation (CNS-1053143) 
546 |a en_US 
655 7 |a Article 
773 |t Proceedings of the Second Asia-Pacific Workshop on Systems (APSys '11)