{"id":{"repo_id":"uiuc","oai_identifier":"oai:www.ideals.illinois.edu:2142/95601"},"canonical_url":"https://search.dev.ndltd.org/etd/uiuc/oai:www.ideals.illinois.edu:2142/95601","repository":{"repo_id":"uiuc","name":"University of Illinois - Urbana-Champaign","base_url":"https://www.ideals.illinois.edu/oai-pmh"},"display":{"title":"Record and replay based virtual-machine introspection for system security","abstract":"Hardware security features need to strike a careful balance between design intrusiveness and completeness of methods. Securing against attacks like Return Oriented Programming (ROP) requires frequent and expensive checks. Complete security defenses have been proposed yet modern systems are still vulnerable to ROP attacks. We provide complete security by decomposing the solution into two stages. The first stage raises alarms based on an imprecise, low cost hardware detector. The second stage applies complete methods in order to accurately distinguish real attacks from false alarms. This decomposition is enabled with Record and Deterministic Replay. The original execution is recorded and subjected to replay analysis as alarms are raised. In this way the Replay infrastructure can compensate for the occasional hardware imprecision. We demonstrate this approach by applying it to thwart ROP attacks on the Linux kernel. We call the design RnR-ROPSafe. It reuses a simple Return Address Stack (RAS) as the hardware detector. The RAS is slightly modified to prevent corruption of the RAS due to multithreading and due to non-procedural returns—improving its performance as a ROP detector. Rare false positives due to underflows are eliminated via replay instead of hardware over-design. RnR-ROPSafe relies on two on-the-fly replayers: an always-on, fast Checkpointing replayer that periodically creates checkpoints, and a detailed-analysis Alarm replayer that is triggered when there is a threat alarm. We find that the first one has execution speed comparable to that of the recorder, and can be replaying all the time, while the latter has to handle only very few false positives.","abstract_html":"Hardware security features need to strike a careful balance between design intrusiveness and completeness of methods. Securing against attacks like Return Oriented Programming (ROP) requires frequent and expensive checks. Complete security defenses have been proposed yet modern systems are still vulnerable to ROP attacks. We provide complete security by decomposing the solution into two stages. The first stage raises alarms based on an imprecise, low cost hardware detector. The second stage applies complete methods in order to accurately distinguish real attacks from false alarms. This decomposition is enabled with Record and Deterministic Replay. The original execution is recorded and subjected to replay analysis as alarms are raised. In this way the Replay infrastructure can compensate for the occasional hardware imprecision. We demonstrate this approach by applying it to thwart ROP attacks on the Linux kernel. We call the design RnR-ROPSafe. It reuses a simple Return Address Stack (RAS) as the hardware detector. The RAS is slightly modified to prevent corruption of the RAS due to multithreading and due to non-procedural returns—improving its performance as a ROP detector. Rare false positives due to underflows are eliminated via replay instead of hardware over-design. RnR-ROPSafe relies on two on-the-fly replayers: an always-on, fast Checkpointing replayer that periodically creates checkpoints, and a detailed-analysis Alarm replayer that is triggered when there is a threat alarm. We find that the first one has execution speed comparable to that of the recorder, and can be replaying all the time, while the latter has to handle only very few false positives.","abstract_has_math":false,"creators":["Shalabi, Yasser Hussein"],"institution":"University of Illinois at Urbana-Champaign","degree_name":"M.S.","degree_level":"Thesis","degree_discipline":"Electrical & Computer Engr","degree_department":null,"school":null,"contributors":["Torrellas, Josep"],"advisors":[],"committee_chairs":[],"committee_members":[],"year":2017,"date_issued":"2017-03-01T17:01:50Z","date_published":"2017-03-01T17:01:50Z","updated_at":"2026-07-22T22:26:37Z","subjects":["Security","Operating systems (OS)","Return oriented programming (ROP)","Virtual machine","Virtual machine introspection (VMI)","Control flow integrity (CFI)"],"languages":["en"],"rights":["Copyright 2016 Yasser Shalabi"],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"http://hdl.handle.net/2142/95601","outbound_label":"Handle","outbound_source":"dc:identifier"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor","label":"Contributor","values":["Torrellas, Josep"]},{"key":"dc:creator","label":"Author","values":["Shalabi, Yasser Hussein"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date","label":"Dc Date","values":["2017-03-01T17:01:50Z","2019-03-02T10:15:27Z","2016-12-01","2016-12"]},{"key":"dc:type","label":"Dc Type","values":["text"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Electrical & Computer Engr"]},{"key":"thesis:degree_level","label":"Degree Level","values":["Thesis"]},{"key":"thesis:degree_name","label":"Degree Name","values":["M.S."]},{"key":"thesis:institution_name","label":"Thesis Institution Name","values":["University of Illinois at Urbana-Champaign"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Security","Operating systems (OS)","Return oriented programming (ROP)","Virtual machine","Virtual machine introspection (VMI)","Control flow integrity (CFI)"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["en"]},{"key":"dc:rights","label":"Dc Rights","values":["Copyright 2016 Yasser Shalabi"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["http://hdl.handle.net/2142/95601"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description","label":"Description","values":["Hardware security features need to strike a careful balance between design intrusiveness and completeness of methods. Securing against attacks like Return Oriented Programming (ROP) requires frequent and expensive checks. Complete security defenses have been proposed yet modern systems are still vulnerable to ROP attacks. We provide complete security by decomposing the solution into two stages. The first stage raises alarms based on an imprecise, low cost hardware detector. The second stage applies complete methods in order to accurately distinguish real attacks from false alarms. This decomposition is enabled with Record and Deterministic Replay. The original execution is recorded and subjected to replay analysis as alarms are raised. In this way the Replay infrastructure can compensate for the occasional hardware imprecision. We demonstrate this approach by applying it to thwart ROP attacks on the Linux kernel. We call the design RnR-ROPSafe. It reuses a simple Return Address Stack (RAS) as the hardware detector. The RAS is slightly modified to prevent corruption of the RAS due to multithreading and due to non-procedural returns—improving its performance as a ROP detector. Rare false positives due to underflows are eliminated via replay instead of hardware over-design. RnR-ROPSafe relies on two on-the-fly replayers: an always-on, fast Checkpointing replayer that periodically creates checkpoints, and a detailed-analysis Alarm replayer that is triggered when there is a threat alarm. We find that the first one has execution speed comparable to that of the recorder, and can be replaying all the time, while the latter has to handle only very few false positives.","Submission published under a 24 month embargo labeled 'Closed Access', the embargo will last until 2018-12-01","The student, Yasser Shalabi, accepted the attached license on 2016-12-01 at 11:00.","The student, Yasser Shalabi, submitted this Thesis for approval on 2016-12-01 at 11:06.","This Thesis was approved for publication on 2016-12-01 at 16:31.","DSpace SAF Submission Ingestion Package generated from Vireo submission #10390 on 2017-02-28 at 14:42:42","Made available in DSpace on 2017-03-01T17:01:50Z (GMT). No. of bitstreams: 2 SHALABI-THESIS-2016.pdf: 362557 bytes, checksum: ba4eeff5fa52bdb6d5c23729df1b0f49 (MD5) LICENSE.txt: 4211 bytes, checksum: 01e25a99edccc51952adc113c951e8a5 (MD5) Previous issue date: 2016-12-01","Embargo set by: Seth Robbins for item 98717 Lift date: 2019-03-01T17:02:22Z Reason: Author requested closed access (OA after 2yrs) in Vireo ETD system","Embargo set by: Seth Robbins for item 98717 Lift date: 2019-03-01T17:03:32Z Reason: Author requested closed access (OA after 2yrs) in Vireo ETD system","Embargo set by: Seth Robbins for item 98717 Lift date: 2019-03-01T17:05:02Z Reason: Author requested closed access (OA after 2yrs) in Vireo ETD system","Embargo set by: Seth Robbins for item 98717 Lift date: 2019-03-01T17:06:55Z Reason: Author requested closed access (OA after 2yrs) in Vireo ETD system","Limited Restriction Lifted for Item 98717 on 2019-03-02T10:15:27Z."]},{"key":"dc:format","label":"Dc Format","values":["application/pdf"]},{"key":"dc:title","label":"Title","values":["Record and replay based virtual-machine introspection for system security"]}]}],"canonical_facts":{"dc:contributor":["Torrellas, Josep"],"dc:creator":["Shalabi, Yasser Hussein"],"dc:date":["2017-03-01T17:01:50Z","2019-03-02T10:15:27Z","2016-12-01","2016-12"],"dc:description":["Hardware security features need to strike a careful balance between design intrusiveness and completeness of methods. Securing against attacks like Return Oriented Programming (ROP) requires frequent and expensive checks. Complete security defenses have been proposed yet modern systems are still vulnerable to ROP attacks. We provide complete security by decomposing the solution into two stages. The first stage raises alarms based on an imprecise, low cost hardware detector. The second stage applies complete methods in order to accurately distinguish real attacks from false alarms. This decomposition is enabled with Record and Deterministic Replay. The original execution is recorded and subjected to replay analysis as alarms are raised. In this way the Replay infrastructure can compensate for the occasional hardware imprecision. We demonstrate this approach by applying it to thwart ROP attacks on the Linux kernel. We call the design RnR-ROPSafe. It reuses a simple Return Address Stack (RAS) as the hardware detector. The RAS is slightly modified to prevent corruption of the RAS due to multithreading and due to non-procedural returns—improving its performance as a ROP detector. Rare false positives due to underflows are eliminated via replay instead of hardware over-design. RnR-ROPSafe relies on two on-the-fly replayers: an always-on, fast Checkpointing replayer that periodically creates checkpoints, and a detailed-analysis Alarm replayer that is triggered when there is a threat alarm. We find that the first one has execution speed comparable to that of the recorder, and can be replaying all the time, while the latter has to handle only very few false positives.","Submission published under a 24 month embargo labeled 'Closed Access', the embargo will last until 2018-12-01","The student, Yasser Shalabi, accepted the attached license on 2016-12-01 at 11:00.","The student, Yasser Shalabi, submitted this Thesis for approval on 2016-12-01 at 11:06.","This Thesis was approved for publication on 2016-12-01 at 16:31.","DSpace SAF Submission Ingestion Package generated from Vireo submission #10390 on 2017-02-28 at 14:42:42","Made available in DSpace on 2017-03-01T17:01:50Z (GMT). No. of bitstreams: 2 SHALABI-THESIS-2016.pdf: 362557 bytes, checksum: ba4eeff5fa52bdb6d5c23729df1b0f49 (MD5) LICENSE.txt: 4211 bytes, checksum: 01e25a99edccc51952adc113c951e8a5 (MD5) Previous issue date: 2016-12-01","Embargo set by: Seth Robbins for item 98717 Lift date: 2019-03-01T17:02:22Z Reason: Author requested closed access (OA after 2yrs) in Vireo ETD system","Embargo set by: Seth Robbins for item 98717 Lift date: 2019-03-01T17:03:32Z Reason: Author requested closed access (OA after 2yrs) in Vireo ETD system","Embargo set by: Seth Robbins for item 98717 Lift date: 2019-03-01T17:05:02Z Reason: Author requested closed access (OA after 2yrs) in Vireo ETD system","Embargo set by: Seth Robbins for item 98717 Lift date: 2019-03-01T17:06:55Z Reason: Author requested closed access (OA after 2yrs) in Vireo ETD system","Limited Restriction Lifted for Item 98717 on 2019-03-02T10:15:27Z."],"dc:format":["application/pdf"],"dc:identifier":["http://hdl.handle.net/2142/95601"],"dc:language":["en"],"dc:rights":["Copyright 2016 Yasser Shalabi"],"dc:subject":["Security","Operating systems (OS)","Return oriented programming (ROP)","Virtual machine","Virtual machine introspection (VMI)","Control flow integrity (CFI)"],"dc:title":["Record and replay based virtual-machine introspection for system security"],"dc:type":["text"],"thesis:degree_discipline":["Electrical & Computer Engr"],"thesis:degree_level":["Thesis"],"thesis:degree_name":["M.S."],"thesis:institution_name":["University of Illinois at Urbana-Champaign"]},"updated_at":"2026-07-22T22:26:37Z"}