The goal of this project is to implement and leverage a system that can browse the past execution of a computer. "Browsing" refers to the ability for a user to search, analyze, summarize, restore, or replay arbitrary data or events that existed or occurred sometime in the past on that user's computer. These capabilities depend on two foundational techniques. Virtual-machine introspection allows the system to understand the execution of a virtual machine as it executes or replays, without perturbing that execution or replay. Virtual-machine replay allows the system to re-execute a past time interval of the virtual machine instruction-by-instruction, yet at only a few percentage overhead in time and space.
The ability to browse the past execution of one's computer can benefit society by providing new capabilities to administrators, users, and programmers. Administrators can use this ability to secure computers more effectively by detecting past intrusions, which may help shrink the ranks of "bot armies" controlled by criminals and spammers. Elderly people with memory loss can use this ability to recall the events that occurred on their computers, such as e-mail exchanges and GUI interactions. Programmers can use this ability to fix difficult non-deterministic bugs and thereby improve the overall robustness of the software on which society has come to depend.
