Process recovery by rollback and input modification. (2015)

• Record Type: Journal Article
• Authors: Oyama, Yoshihiro; Tomiyama, Takaaki
• Is Part Of: International journal of communication networks and distributed systems. Volume 15:Number 1(2015)
• Page Start: 61
• Page End: 83
• Publication Date: 2015
• Subjects: operating systems -- sandbox -- checkpointing -- rollback -- self-healing -- process-level virtualisation -- ptrace -- system call interception -- security policy -- process recovery -- input modification -- software vulnerability attacks; Computer networks -- Periodicals; Telecommunication systems -- Periodicals; Electronic data processing -- Distributed processing -- Periodicals; 004.6
• Languages: English
• ISSNs: 1754-3916

Abstract

An effective countermeasure against software vulnerability attacks is a security system that executes a process in a confined or monitored environment. This type of security system isolates compromised software from other software and thus minimises the influence of attacks. However, several problems occur when a security system, without taking any other action, terminates a process that violates a security policy or encounters a fault. In this paper, we propose ProcHealer, a security system that does not terminate the offending process, but instead rolls it back to the pre-violation or pre-fault state where the process can be restarted and remediated. Security policy violations and faults are often caused by anomalous external inputs. In the restarted execution, ProcHealer therefore provides the process with a modified version of the external input.