Antivirus Software Isolation via Virtual Machine Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern antivirus software applications face challenges in protecting themselves against zero-day attacks and need to reduce the vulnerability window during update processes.
Innovation Solution
The implementation of a computer system with a hypervisor managing multiple virtual machines, where antivirus software runs isolated from user applications and the operating system, allowing for monitoring and updating without disrupting normal operations, and enabling secure detection and recovery from malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If antivirus software runs integrated with the operating system and user applications, then ease of operation is improved, but reliability deteriorates due to vulnerability to zero-day attacks
Solution Approach 1:
The system divides the computing environment into separate virtual machines: a host VM running the operating system and user applications, and a guest VM running the antivirus software. This segmentation isolates the antivirus from direct exposure to threats in the host environment, maintaining reliability while preserving ease of operation through virtualized integration.
Solution Approach 2:
A hypervisor acts as an intermediary layer between the host operating system and the antivirus software running in the virtual machine. This mediator enables the antivirus to monitor and protect the system without being directly integrated into the OS, thereby maintaining both ease of operation and reliability against zero-day attacks.
2Reliability
If antivirus software is isolated in a virtual machine, then reliability is improved against malware attacks, but device complexity increases due to virtualization infrastructure
Solution Approach 1:
The hypervisor provides multiple functions: it manages virtual machine resources, enables communication between the antivirus VM and host system, and maintains security isolation. This multi-functionality reduces the need for additional dedicated components, thereby improving reliability while limiting the increase in device complexity.
3Measurement precision
If antivirus software monitors all user applications in real-time, then detection precision is improved, but loss of time increases due to system performance impact
Solution Approach 1:
The antivirus software in the virtual machine performs monitoring of user applications and system calls, but not all operations are subjected to full-depth analysis. The virtualized environment allows selective monitoring of critical operations, maintaining detection precision while reducing the time overhead on the host system through efficient resource management by the hypervisor.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
The systems, methods and apparatuses described herein provide a computing system for executing an antivirus software program. In one aspect, a non-transitory computer- readable medium may comprise an antivirus software program to be executed in a first virtual machine by a computer processor that supports multiple virtual machines. The antivirus software program may obtain access to a memory of a second virtual machine on the computer processor that supports multiple virtual machines, and use the access to the memory of the second virtual machine to monitor the memory of the second virtual machine and take a corrective action. In a further aspect, the corrective action may be to remove any malware found on a computer operating system that is running on the second virtual machine.