Reconstructing System State for Intrusion Analysis

摘要

The analysis of a compromised system is a time-consuming and error-prone task today because commodity operating systems provide limited auditing facilities. We have been developing an operating-system level auditing system called Forensix that captures a