Analysis of Virtual Machine Record and Replay for Trustworthy Computing

Many effective techniques for defending against computer attacks are impractical because they would significantly impair application performance. Enforcing a property called control-flow integrity, for example, can ensure that a program's execution does not diverge from a specific, predetermined set of paths, but doing so diverts computational resources from the program as it runs. To enable practical uses of these techniques, we have implemented the virtual machine record and replay (RnR) prototype for modern x86 computers. RnR separates live execution from analysis by recording an executing virtual machine at speed and conducting computationally intensive analysis separately on a replay of the virtual machine. Our findings are that the performance overhead of the recording mechanism is minimal (less than 5% for common workloads) and that, therefore, the recording mechanism provides a resource-friendly way to deploy previously impractical techniques.