Design, implementation, and evaluation of repairable file service

Abstract

The data contents of an information system may be corrupted due to security breaches or human errors. This project focuses on intrusion tolerance techniques that speed up the process of repairing a damaged file system. The proposed system, called Repairable File Service (or RFS), is specifically designed to facilitate the repair of compromised network file servers. An architectural innovation of RFS is that it is decoupled from and requires no modifications on the shared file server that is being protected. RFS supports fine-grained logging to allow roll-back of any file update operation, and keeps track of inter-process dependencies to quickly determine the extent of system damage after an attack/error. Compared with the current practice of manual post-intrusion damage repair, RFS significantly reduces the mean time to repair and thus improves the overall system availability. Performance overhead of RFS is less than 6%.0-7695-1959-8/03 $17.00 (c) 2003 IEEE

Suspicious-taint-based access control for protecting OS from network attacks

“…It can help administrators to find intrusion steps with the help of the dependency graph that is generated by logging and analyzing OS events. Zhu and Chiueh built a repairable file service named RFS [11] , which supports kernel logging to allow roll-back of any file update operation, and keeps track of inter-process dependencies to quickly determine the extent of system damage after an attack/error. In 2005, Ashvin Goel and Kenneth Po built an intrusion recovery system named taser [12] , which helps in selectively recovering file-system data after an attack.…”

Detecção e recuperação de intrusão com uso de controle de versão

“…Zhu & Chiueh [70] implementou um sistemas de arquivos com suporte a este tipo de recuperação, permitindo ao usuário recuperar o estado dos arquivos para uma data anterior. Para isto criaram um sistema de log detalhado de qualquer operação de escrita no sistema de arquivos, isto faz com que qualquer operação deste tipo seja reversível.…”

“…Consiste em manter árvores de versões para cada arquivo, em para cada versão existem detalhes da transação feita para armazenar somente a diferença entre elas, o que permite uma recuperação eficiente e elegante. O sistema de Zhu & Chiueh [70] pode ser considerado um método de versionamento também, porém não guarda as operações baseando-se no conteúdo de cada arquivo, seu método analisa as operações no nível de bloco, desconsiderando qual arquivo está sendo manipulado na operação.…”