On a /spl mu/-kernel based system architecture enabling recovery from rootkits

We present a system architecture called spine that supports detection and recovery from many kernel-level and user-level rootkits. The architecture forms a reliable basis for an intrusion recovery system (IRS). The spine architecture is a multi-tiered approach, relying on the integrity of a small /spl mu/-kernel based hypervisor for correctness at the base level. Spine vertebrae are positioned at each level in the system in order to overcome the semantic gap in the understanding of system state. We discuss the design of the system, highlighting the main advantages and disadvantages from other approaches. A series of attacks are conducted against the prototype system in order to test for correctness and time to recover. Finally, some system performance benchmarks are presented that show that a small performance penalty is incurred from the increased reliability.