{'fraction_non_alphanumeric': 0.012779552715654952, 'fraction_numerical': 0.0, 'mean_word_length': 5.492227979274611, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Iterative Backtracking via Deterministic Virtual Machine Replay and Virtual Machine Introspection

We propose a security analysis system that enables tracking and understanding system intrusions fully and precisely, using deterministic virtual machine replay and virtual machine introspection. Understanding the behaviors of system intrusions is important for malware defense systems to discover their vulnerabilities and prevent them to be exploited for the future. Existing approaches fail to explain the complete details of intrusion paths trying to balance between overheads from logging/analysis and performance. We adopt deterministic VM replay to record the whole execution of a target system, take the replay log off-line, and perform analysis on a replayed session of the execution. Further, our analysis engine effectively overcomes the semantic gap between an analysis algorithm and the low-level state of a guest VM implementing a powerful debug symbol library and core VM introspection component. Along with the replay and analysis engines, our new analysis model naturally breaks the complex behavior of an intrusion into a number of small questions and tries to answer to them one by one in a repeated, retrospective, and precise manner.