CSR---PDOS: Browsing the Past Through Virtual-Machine Introspection and Replay

CSR---PDOS：通过虚拟机内省和重放浏览过去

• 批准号: 0614985
• 负责人: Peter Chen
• 金额: $ 50.18万
• 依托单位: Regents of the University of Michigan - Ann Arbor
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2006
• 资助国家: 美国
• 起止时间: 2006-08-01 至 2011-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0614985&HistoricalAwards=false
• 关键词: CSR; PDOS; Browsing; Past; Through

The goal of this project is to implement and leverage a system that canbrowse the past execution of a computer. "Browsing" refers to the abilityfor a user to search, analyze, summarize, restore, or replay arbitrary dataor events that existed or occurred sometime in the past on that user'scomputer. These capabilities depend on two foundational techniques.Virtual-machine introspection allows the system to understand the executionof a virtual machine as it executes or replays, without perturbing thatexecution or replay. Virtual-machine replay allows the system to re-executea past time interval of the virtual machine instruction-by-instruction, yetat only a few percentage overhead in time and space.The ability to browse the past execution of one's computer can benefitsociety by providing new capabilities to administrators, users, andprogrammers. Administrators can use this ability to secure computers moreeffectively by detecting past intrusions, which may help shrink the ranksof "bot armies" controlled by criminals and spammers. Elderly people withmemory loss can use this ability to recall the events that occurred ontheir computers, such as e-mail exchanges and GUI interactions. Programmerscan use this ability to fix difficult non-deterministic bugs and therebyimprove the overall robustness of the software on which society has come todepend.

该项目的目标是实现和利用一个可以浏览计算机过去执行情况的系统。 “浏览”是指用户搜索、分析、总结、恢复或重放该用户计算机上过去某个时间存在或发生的任意数据或事件的能力。 这些功能取决于两种基本技术。虚拟机自省允许系统在执行或重放时了解虚拟机的执行情况，而不会干扰该执行或重放。 虚拟机重放允许系统逐条指令地重新执行虚拟机过去的时间间隔，但在时间和空间上只需要几个百分比的开销。浏览计算机过去执行的能力可以通过提供新的信息来造福社会。管理员、用户和程序员的能力。 管理员可以利用此功能通过检测过去的入侵来更有效地保护计算机，这可能有助于缩小犯罪分子和垃圾邮件发送者控制的“机器人大军”的规模。 记忆丧失的老年人可以利用这种能力回忆起计算机上发生的事件，例如电子邮件交换和 GUI 交互。 程序员可以利用这种能力来修复困难的非确定性错误，从而提高社会所依赖的软件的整体稳健性。