Specification Language: Reactions
execute system call normally
return fake return values/bogus data
log the activity for later analysis
take alternative actions to isolate process
- manipulate a different resource than what is specified in the system call
reduce consumption of system resources
- delay system call
- limit usage of CPU, memory, etc.
switch to new specification, e.g., to do finer or coarser grained monitoring