Fast and Service-preserving Recovery from Malware Infections Using CRIU
summary
CRIU-MR uses a patched CRIU plus an agent that ingests IDS/IPS JSON alerts, checkpoints a Linux container, omits policy-flagged processes, swaps in a clean filesystem snapshot, and restores remaining processes with live TCP connections preserved. Evaluation removes six malware types (miners, reverse shells, exploit payloads), maintains connections across up to 140 concurrent clients, and completes recovery in about 3 seconds. Implementation is open source, runs on Linux containers, and exposes policies via CRIU-MR.
AI-written summary · about
chapters (15)
- 0:00Start
- 1:00INTRODUCTION
- 1:35MOTIVATING EXAMPLE
- 5:08SOLUTION COMPONENTS: LXC - LINUX CONTAINERS
- 5:50SOLUTION COMPONENTS: CRIU - CHECKPOINT AND RESTORE IN USERSPACE
- 8:07POLICY MATCHES
- 8:48IMPLEMENTATION: CRIU MODIFICATIONS
- 10:38CRIU-MR AGENT: FILESYSTEM RESTORE
- 11:04INFECTION RECOVERY STEPS
- 12:07EXPERIMENT : MALWARE RECOVERY TIME
- 13:20EXPERIMENT II: AVAILABILITY IMPACT STRESS TEST
- 15:01DISCUSSION
- 16:06LIMITATIONS
- 16:53FUTURE WORK
- 17:59CONCLUSIONS
related talks
27m“Why are they asking me to do this?” or Adventures in IR Land
20mCRIU and SELinux
33mFreeze,Investigate,Recover: Unlocking Forensic Container Checkpoint...
31mUNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware
23mPensieve: Finding Malicious Artifacts in Container Environments
29mNo More Ransomware in Critical Infrastructure!
21mAutomating dynamic malware analysis
33mProactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware