Analyzing the behavior of running programs has a wide variety of compelling applications, from intrusion detection and prevention to bug discovery. Unfortunately, the high runtime overheads imposed by complex analysis techniques makes their deployment impractical in most settings. We present a virtual machine based architecture called Aftersight ameliorates this, providing a flexible and practical way to run heavyweight analyses on production workloads.

Aftersight decouples analysis from normal execution by logging nondeterministic VM inputs and replaying them on a separate analysis platform. VM output can be gated on the results of an analysis for intrusion prevention or analysis can run at its own pace for intrusion detection and best effort prevention. Logs can also be stored for later analysis offline for bug finding or forensics, allowing analyses that would otherwise be unusable to be applied ubiquitously. In all cases, multiple analyses can be run in parallel, added on demand, and are guaranteed not to interfere with the running workload.

We present our experience implementing Aftersight as part of the VMware virtual machine platform and using it to develop a realtime intrusion detection and prevention system, as well as an an offline system for bug detection, which we used to detect numerous novel and serious bugs in VMware ESX Server, Linux, and Windows applications.

/pdf/decoupling-dynamic-program-analysis-from-execution-in-1bqpqu6d7h.pdf

Decoupling dynamic program analysis from execution in virtual environments

A system and method for converting byte code of a first type into byte code of a second type. Byte code of a first type and markup language code are received as inputs. The first byte code is converted into constituent byte code data elements that can comprise any logical unit or grouping of at least a portion of a software application. The markup language code is converted into constituent markup language data elements that can comprise individual markup language tags and references to data or functionality in the first byte code. The first byte code data elements and markup language data elements are mapped to data elements of a second byte code type. The second byte code data elements are assembled into a resulting second byte code.

System and method for creating target byte code

Techniques are described for unifying static and dynamic compiler optimizations in source code bases. In an embodiment, a first compiler compiles source code of a target function to generate ahead-of-time (AOT) compiled machine code. A second compiler compiles the source code to generate an intermediate representation (IR) of the target function. In response to determining that the target function should be just-in-time (JIT) compiled, the AOT-compiled machine code for the target function is linked to the IR of the target function. During runtime, a physical processor executes AOT-compiled machine code of an executable program. When the target function is encountered for the first time, a JIT compiler is invoked. The JIT compiler generates JIT-compiled machine code for the target function. The physical processor executes the JIT-compiled machine code in place of the AOT-compiled machine code for the target function.

Unifying static and dynamic compiler optimizations in source-code bases

A virtual machine system decouples dynamic program analysis from program execution. Program analysis is decoupled from program execution through the use of a virtual machine to record program execution and an analysis platform to replay and analyze the program execution. Optimization techniques are applied to prevent the analysis platform from falling too far behind the program execution platform during replay.

Accelerating replayed program execution to support decoupled program analysis

Because Remote Procedure Calls do not compose efficiently, designers of distributed object systems use Data Transfer and Remote Facade patterns to create large-granularity interfaces, hard-coded for particular client use cases. As an alternative to RPC-based distributed objects, this paper presents Remote Batch Invocation (RBI), language support for explicit client-defined batches. A Remote Batch statement combines remote and local execution: all the remote code is executed in a single round-trip to the server, where all data sent to the server and results from the batch are communicated in bulk. RBI supports remote blocks, iteration and conditionals, and local handling of remote exceptions. RBI is efficient even for fine-grained interfaces, eliminating the need for hand-optimized server interfaces. We demonstrate RBI with an extension to Java, using RMI internally as the transport layer. RBI supports large-granularity, stateless server interactions, characteristic of service-oriented computing.

/pdf/remote-batch-invocation-for-compositional-object-services-3cji78jh80.pdf

Remote Batch Invocation for Compositional Object Services

Methods and apparatus to call native code (120) from a managed code application (106) and to optimize such calls are disclosed. An example method includes converting a first bytecode (106) to a first intermediate representation (114), receiving a second intermediate representation (102) including a call to a native function (120) and at least one annotation describing the native function (120), and replacing a portion of the first intermediate representation (114) with a portion of the second intermediate representation (102) to create a third intermediate representation (118).

Methods and apparatus to call native code from a managed code application

Methods and apparatus are disclosed to tune intermediate representations in a managed runtime environment. An example method disclosed herein receives a bytecode at a virtual machine during runtime, determines a method of the received bytecode, identifies an optimized intermediate representation associated with the method, and imports the optimized intermediate representation from the memory into the virtual machine. Other embodiments are described and claimed.

Methods and apparatus to tune intermediate representations in a managed runtime environment

In this paper, we evaluate the emerging Transactional Memory (TM) area by developing a set of Java transactional memory workloads and studying their performance under a Java Software Transactional Memory (STM) system and comparing them to their lock based counterparts. We provide a detailed performance and memory consumption analysis of the overheads of software transactional memory and transactional workloads within a production quality open source Java Runtime system. Additionally, we detail the impact of the various performance optimizations in both workloads and the underlying runtime system to improving both single thread performance and scalability.

Vyacheslav Pavlovich Shakin

Papers

Methods and apparatus to call native code from a managed code application

Methods and apparatus to tune intermediate representations in a managed runtime environment

Practical experiences with Java software transactional memory