Asynchronous Exception Analysis for Virtual Machine Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computer security systems, particularly in hardware virtualization environments, face inefficiencies in event detection and analysis due to vulnerabilities in hooking methods and high computational overhead from complex behavioral signatures, leading to negative user experiences and increased false positives.
Innovation Solution
The implementation of a dual exception analysis system using synchronous and asynchronous exception analyzers that selectively retrieve rule exception signatures to determine the maliciousness of a target entity, allowing for reduced computational overhead and improved user experience by allowing the entity to continue execution during asynchronous analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If synchronous exception analysis is used to determine maliciousness, then detection accuracy is improved, but execution time is increased and user experience deteriorates
Solution Approach 1:
The exception analysis is segmented into two independent analyzers: synchronous exception analyzer for immediate detection and asynchronous exception analyzer for detailed analysis. This segmentation allows the system to perform both quick initial assessment and thorough investigation without one blocking the other, resolving the contradiction between detection accuracy and execution time.
Solution Approach 2:
The synchronous exception analyzer performs preliminary action by conducting initial exception analysis immediately when an event occurs. This preliminary detection provides quick results for common cases, reducing execution time for benign events while maintaining detection accuracy through the subsequent asynchronous analyzer for suspicious cases.
2Measurement precision
If complex behavioral signatures are used for malware detection, then detection capability is improved, but computational overhead increases
Solution Approach 1:
The system applies partial action by using simple exception signatures for initial filtering in the synchronous analyzer, and only applying complex behavioral signature analysis through the asynchronous analyzer when needed. This partial application of complex analysis reduces overall computational overhead while maintaining detection capability for suspicious entities.
Solution Approach 2:
Different quality levels of analysis are applied locally to different events: simple exception matching is applied to all events for quick filtering, while complex behavioral signature analysis is applied locally only to events that pass through the synchronous analyzer and show suspicious patterns, optimizing the balance between detection capability and computational overhead.
3Reliability
If entity execution is suspended for event analysis, then security monitoring is improved, but user experience deteriorates
Solution Approach 1:
The monitoring system is segmented into synchronous and asynchronous analysis paths. The synchronous analyzer provides immediate security monitoring by suspending execution only briefly for initial assessment, while the asynchronous analyzer continues detailed analysis in the background without further suspending execution. This segmentation maintains security monitoring reliability while minimizing impact on user experience.
Solution Approach 2:
The asynchronous exception analyzer enables continuity of useful action by resuming entity execution after the synchronous analysis completes, while continuing the detailed security analysis in the background. This allows the entity to continue its useful work without prolonged suspension, maintaining both security monitoring and user experience.
Data Source
Figure 1~2-A
Figure 2-B~3
Figure 4-A~4-B
AI summary
Described systems and methods enable an efficient analysis of security-relevant events, especially in hardware virtualization platforms. In some embodiments, a notification handler detects the occurrence of an event within a virtual machine, and communicates the respective event to security software. The security software then attempts to match the respective event to a collection of behavioral and exception signatures. An exception comprises a set of conditions which, when satisfied by an <event, entity> tuple, indicates that the respective entity is not malicious. In some embodiments, a part of exception matching is performed synchronously (i.e., while execution of the entity that triggered the respective event is suspended), while another part of exception matching is performed asynchronously (i.e., after the triggering entity is allowed to resume execution).