Towards an approach for automatically repairing compromised network systems

Abstract

The widely accepted method to repair a compromised system is to wipe the system clean and reinstall. We think that there may be alternative methods. Specifically, we envision systems that are capable of automatically recovering from system compromises. Our proposed approach is a repair agent that resides in an isolated area on the system. We use a virtual machine approach to isolate the repair agent. The repair agent should roll back any undesirable changes, determine the point of entry, and prevent further compromise.

Forensic Analysis of File System Intrusions Using Improved Backtracking

“…OS Virtual Machines that were introduced to enable time-sharing of expensive hardware are now used in a variety of applications [14] [15]. The secure and fine granular logging of system execution that virtual machines provide can be used in intrusion detection [13].…”

Contribution to the Design of a Flexible and Adaptive Solution for the Management of Heterogeneous Honeypot Systems

“…Besides, Krawetz [82] mentioned that the adversaries can poison the detected honeypot in order to set obstacle to data capture and they can even install some rootkits in the compromised system for study. Grizzard et al proposed some methods [84] [85] to repair the detected and compromised system and re-establish trust in honeypot.…”