MURI Automated Intrusion Recovery Project
Introduction
Objective:
Develop self-regenerative enterprise networks that recover and re-constitute themselves after attacks and failures.
Develop a transaction-based model for commodity operating systems to determine where an attack occurred, what data or programs were altered, and back-out all these changes without affecting unrelated data/activities.
Automatically generate patches to make systems more robust after attack.
Technical Approach:
Develop a layered approach to self-regenerative systems:
Application-level resilience using error virtualization and rescue points.
System-level resilience using virtualization and transaction semantics for programs to roll back system state to the last known good continuation point.
Dynamic patching of applications to improve resiliency after attack.
Roll forward with correction to quarantine tainted processes and files & back-out changes.
DoD Benefit:
Uninterruptible service for critical network centric warfare services. Error localization and tolerance in applications.
Automatic system recovery after attack including quarantine of tainted processes and data.
Increased resiliency after attack through auto-patch generation.
Accomplishments:
At 1 DoS Attack/s, system sustains 92% of throughput under non-attack conditions.
At 8 DoS Attacks/s, system sustains 60% of throughput.
|
