Project Proposal

Currently, intrusion analysis and recovery is a manual and tedious process. There have been several attempts at expediting the operation by automating some aspects of the process. Taser intrusion recovery is one such system. It logs system calls and is able to derive a dependency tree of kernel objects which aids in determining the list of files tainted by an intruder or software misconfiguration. Additionally, through the use of logging and snapshots, Taser is able to restore the tainted files to their pre-intrusion versions. Although Taser presents a powerful new approach to intrusion analysis and recovery, it suffers from systematic false positives in certain scenarios and is vulnerable to multi-session attacks. For example, if a heavily shared file is modified by a tainted object, every process that reads the shared file will, in turn, become marked as tainted by Taser. In many cases, such as a password file, this will be inappropriate. An approach based on application replay has been proposed to aid in establishing whether a file is truly tainted. The application would be re-executed several times in the same environment, using tainted inputs (such as files) and clean versions of the inputs. If the output of the application is significantly different with the untainted version of the input, for example the attacker is unable to log in, we can conjecture that the application was dependent on the tainted input. This could be an effective technique for eliminating false positives.