Dynamic Guest Image Creation for Exploit Detection and Rollback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional exploit detection schemes using virtual machines often produce false negatives due to generalized software profiles that differ from actual operating states of computers, and remediation techniques are slow and labor-intensive, affecting productivity.
Innovation Solution
A threat detection and prevention system utilizing dynamic guest images that represent the current operating state of client devices, allowing for real-time dynamic analysis and rapid remediation by generating and storing guest images in response to changes, enabling accurate exploit detection and swift restoration of non-infected states.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If general software profiles are used in virtual machines for exploit detection, then the system can widely test different OS and application types, but false negatives occur because the profiles differ from actual operating states of computers
Solution Approach 1:
The system captures the actual operating state of the client device beforehand (creating a guest image before potential infection) and uses this pre-captured state to configure the virtual machine for exploit detection. This preliminary action ensures the VM matches the real device configuration, eliminating false negatives while maintaining adaptability across different OS and application types.
Solution Approach 2:
Instead of using generalized software profiles, the system creates an exact copy of the client device's actual operating state through guest images. These images capture the specific OS version, installed applications, and configuration details, allowing the VM to accurately replicate the real device environment for precise exploit detection.
2Ease of repair
If conventional remediation techniques are used, then infected computers can be restored, but the process is slow and labor-intensive, taking hours or days and affecting productivity
Solution Approach 1:
The system performs remediation in advance by continuously capturing guest images of the client device's operating state. When infection is detected, the system immediately restores the device to a previously captured clean state, eliminating the need for slow manual remediation processes and reducing downtime to minutes rather than hours or days.
Solution Approach 2:
The system enables automatic remediation where the infected device restores itself using pre-captured guest images without requiring manual IT intervention. This self-service capability significantly reduces remediation time and allows employees to quickly resume work, maintaining productivity while ensuring infected devices are restored to clean states.
Data Source
AI summary
According to one embodiment, a computerized method comprises three operations. First, an exploit is determined to have been activated on a client device to transition a state of the client device from a non-infected state to an infected state. Second, a software image is determined prior to the client device receiving the object including the exploit. Lastly, an operating state of the client device is restored by at least reinstalling the software image on the client device so that the client device reverts to an operating state of the client device prior to activation of the exploit.