Paper Info
Title
MOSE: Live Migration Based On-the-Fly Software Emulation.
Abstract
Software emulation has been proven useful in many scenarios, such as software testing, malware analysis, and intrusion response. However, fine-grained software emulation (e.g., at the instruction level) incurs considerable execution overhead (about 8x performance degradation), which hampers its use in production settings. In this paper, we propose MOSE (Live Migration based On-the-fly Software Emulation) that combines the performance advantages of hardware virtualization and the fine-grained analysis capability (comprehensiveness) of whole-system software emulation. Namely, a system can run as normal on a hardware-virtualized platform at near native speed, but when needed, it can be live-migrated to an emulator, not necessarily running on the same physical system, for in-depth analysis and triage; when the analysis is complete, the virtual machine can be migrated back to benefit from full hardware-virtualization again. In this way, the performance degradation is only experienced during analysis and triage. To demonstrate this new capability, we built a proof of concept on-the-fly software emulation system, based on QEMU/KVM and DECAF, the Dynamic Executable Code Analysis Framework. We also perform three case studies: automated kernel panic triage, live-patching a security vulnerability, and on-demand symbolic execution, to illustrate on-demand instruction level analysis.
Year
DOI
Venue
2015
10.1145/2818000.2818022
ACSAC
Field
DocType
Citations 
Virtual machine,Software analysis pattern,Computer security,Computer science,Live migration,Real-time computing,Hardware emulation,Executable,Hardware virtualization,Semulation,Software construction,Operating system,Embedded system
Conference
2
PageRank 
References 
Authors
0.37
4
3
Name
Order
Citations
PageRank
Jinpeng Wei122120.22
Lok-Kwong Yan228813.56
Muhammad Azizul Hakim320.37