The document discusses a system that provides rapid recovery from attacks and increased security for virtual machines using techniques like virtual machine checkpoints, network and file system monitoring to isolate attacks and roll back changes, and defining rules to restrict the behavior of virtual appliances. It proposes a prototype architecture that leverages these techniques and evaluates performance and functionality. The plan of work is to further integrate network and file system monitoring components tightly with the Xen virtual machine monitor and implement a comprehensive set of rules for defining allowed virtual appliance behaviors.

1. System Support for Rapid Recovery and Attack Resistance A Seminar by Todd Deshane Advisor: Jeanna Matthews

4. VMM with a Picture

11. "New methods are being invented, new tricks, and every year it gets worse... We are losing the battle... Most companies don't know they have been attacked." - Bruce Schneier "The average top executive doesn't understand security, but we have to change that... Security is an imperative. It's no longer just a good idea." - Allen Kerr "Virus incidences had surged between 2003, when they detected just over 10,000, and 2006, when they found 80,000. Criminal activity accounted for most of that increase." - Kaspersky Labs

12. "Very sophisticated tools are commercially available in black markets... This has made [the Internet] more attractive for organized crime: [criminals] no longer have to be geeks." - James Lewis "Although security awareness continues to improve, hackers and malicious code authors are releasing threats faster than ever before, with approximately 200 per cent more malicious threats per day than two years ago." - Stuart McClure "Over one third [of IT Companies] hit by a denial-of-service attack while over 44 percent had experienced either a pharming or cache poisoning attack." - Recent Secure64 Survey

18. Prototype Architecture

23. Evaluation of Prototype: Performance

26. Plan: Modified Architecture

30. Questions/Comments?

31. Backup Slides

37. Plan: File System Rule Language # Example file system rule set for an email client. fs_rule = [ 'id=1, read, 1024, 5' ] # read at most 1024 bytes of data in 5 seconds fs_rule = [ 'id=2, append, 1024, 3' ] # append at most 1024 bytes of data in 3 seconds. fs_rule = [ 'id=3, write, 320, 3' ] # write at most 320 bytes in 3 seconds # The email mount point is accessible to the email client, and fs_rules # with id=1 and id=2 are applied disk = [ 'fsvm:/mnt/email, /home/user/mail,fs_rule=1:2' ] # The email mount point is accessible to the email client, and fs_rules # with id=1 and id=3 are applied. disk = [ 'fsvm:/mnt/email, /home/user/attachments,fs_rule=1:3' ]

38. Plan: Network Rule Language #Email client example continued network_rule = ['id=1, iptables, file=/etc/iptables/email_client'] network_rule = ['id=2, snort, file=/etc/snort/rules/email_client'] vif = [ 'rate=2Mb/s, network_rule=1:2' ]

39. Questions/Comments?