Cloned VM Gray App Whitelisting Without Downtime
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional endpoint protection mechanisms, such as blacklisting and whitelisting, struggle to effectively manage the rapid emergence of new malware and gray applications, leading to difficulties in identifying and classifying safe runtime behavior in time to prevent threats.
Innovation Solution
A virtualized computing environment is used where gray applications are executed and monitored in a cloned virtual machine, allowing real-time classification and delayed execution until deemed safe by an application admission control manager, ensuring continuous system operation without downtime.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a whitelisting strategy is adopted to improve endpoint security, then security effectiveness is improved, but the ability to quickly adapt to new applications deteriorates
Solution Approach 1:
The system performs preliminary actions by creating a cloned virtual machine instance before executing the gray application. This clone is used to pre-analyze the application's runtime behavior in a controlled environment, allowing the system to evaluate security risks before the application runs on the production system. This preliminary analysis enables the whitelisting mechanism to adapt to new applications without compromising security.
Solution Approach 2:
A cloned virtual machine acts as an intermediary between the gray application and the production system. The clone provides a safe intermediate environment for executing and monitoring the application, allowing security analysis without direct exposure to the main system. This intermediary approach enables the system to handle new applications dynamically while maintaining security boundaries.
2Reliability
If gray applications are analyzed before execution to ensure safety, then security is improved, but system downtime increases
Solution Approach 1:
Instead of analyzing applications sequentially on the production system, the system creates a copy (clone) of the virtual machine environment specifically for analysis purposes. This copying approach allows parallel execution of the analysis process, eliminating the need to halt the production system. The cloned environment handles the time-consuming analysis tasks without affecting production availability.
Solution Approach 2:
The system segments the virtual machine into a production instance and a cloned analysis instance. This segmentation allows the analysis functions to be performed on the clone while the production system continues to operate normally. The separation of analysis and production functions eliminates the trade-off between security checking and system availability.
3Measurement precision
If system administrators manually classify each gray application, then classification accuracy is improved, but administrative burden increases
Solution Approach 1:
The system enables self-service by automatically performing the classification of gray applications through monitoring their runtime behavior in the cloned virtual machine. The application admission control manager autonomously evaluates the monitored behavior against security policies and makes classification decisions without requiring manual administrator intervention. This automation maintains classification accuracy while eliminating the administrative burden of manually reviewing each gray application.
Solution Approach 2:
The system implements feedback mechanisms where the runtime behavior monitoring continuously provides data to the application admission control manager. This feedback loop enables automated classification decisions based on observed behavior patterns, replacing manual classification processes. The feedback-driven approach maintains high classification accuracy through continuous monitoring while reducing administrative workload through automation.
Data Source
AI summary
In a virtualized computer system, gray applications that are selected to be executed in a first virtual computing instance are executed and monitored in a second virtual computing instance that is a clone of the first virtual computing instance, and classified according to their monitored behavior. This process is conducted in real-time, in response to a notification that a gray application has been selected for execution in the first virtual computing instance. The execution of the gray application in the first virtual computing instance is delayed until the first virtual computing instance receives a notification from an application admission control manager that the gray application is safe to be executed in the first virtual computing instance. Although the execution of the gray application in the first virtual computing instance is delayed, all other processes running in the first virtual computing instance continue to their execution so that a user accessing the first virtual computing instance will not experience any downtime.