Process evaluation for malware detection in virtual machines

Abstract

Described systems and methods allow protecting a computer system from malware, such as viruses and rootkits. An anti-malware component executes within a virtual machine (VM) exposed by a hypervisor executing on the computer system. A memory introspection engine executes outside the virtual machine, at the processor privilege level of the hypervisor, and protects a process executing within the virtual machine by write-protecting a memory page of the respective process. By combining anti-malware components executing inside and outside the respective VM, some embodiments of the present invention may use the abundance of behavioral data that inside- VM components have access to, while protecting the integrity of such components from outside the respective VM.

Description

Background technique [0001] The present invention relates to systems and methods for protecting computer systems from malware, and more particularly to anti-malware systems using hardware virtualization techniques. [0002] Malware (Malicious software) (abbreviated as malware in English) affects a large number of computer systems worldwide. Malware in its many forms (eg, computer viruses, worms, and rootkits) poses a serious threat to millions of computer users, making computer users prone to loss of data and sensitive information, identity theft, and loss of productivity. [0003] Hardware virtualization techniques allow the creation of simulated computer environments, often referred to as virtual machines, which in many respects behave like a physical computer system. In typical applications such as server consolidation and Infrastructure as a Service (IAAS), several virtual machines can run simultaneously on the same physical machine, sharing hardware resources between the...

AI Technical Summary

Problems solved by technology

Malware in its many forms (such as computer viruses, worms and rootkits) poses a serious threat to millions of computer users, making computer users prone to loss of data and sensitive information, identity theft and loss of productivity, etc.

Images