Hypervisor-Mediated Access Control for Fileless Malware
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures in virtualization environments are inadequate in preventing the execution of fileless malware, which can exploit vulnerabilities and gain unauthorized access to computer systems, due to the complexity and computational expense of hardware virtualization configurations.
Innovation Solution
Implementing a hypervisor-mediated memory access control mechanism, combined with a filter driver and VM locker logic, to intercept and deny execution requests of injected shellcode, thereby preventing its execution and mitigating security vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional OS-mediated security measures are used, then ease of operation is maintained, but security against fileless malware is insufficient
Solution Approach 1:
The patent introduces a hypervisor-mediated security layer that acts as an intermediary between the operating system and the virtual machines. This hypervisor layer intercepts and monitors memory access requests, preventing fileless malware from executing malicious shellcode while maintaining OS-level security management. The hypervisor serves as the mediator that enforces security policies without requiring changes to the existing OS security infrastructure.
2Difficulty of detecting and measuring
If comprehensive security scanning and monitoring are implemented, then security detection capability is improved, but computational overhead increases
Solution Approach 1:
The patent implements preliminary security measures by establishing hypervisor-mediated memory access controls before malware execution occurs. The system pre-configures security policies and memory protection mechanisms at the hypervisor level, enabling automatic interception of malicious shellcode execution attempts without requiring real-time computational analysis. This preliminary setup reduces the need for ongoing computational scanning and monitoring.
3Reliability
If hypervisor-mediated memory access control is implemented, then security against fileless malware is improved, but device complexity increases
Solution Approach 1:
The patent leverages the existing hypervisor infrastructure to perform multiple functions: virtual machine management, memory allocation, and security enforcement. By making the hypervisor multi-functional, the system achieves enhanced security against fileless malware without adding separate dedicated security hardware or software layers. The hypervisor's existing memory management capabilities are extended to include security control functions.
Data Source
AI summary
Techniques for protecting a computer system against fileless malware are described. One technique includes a virtual machine (VM) locker logic/module implemented by one or more processors receiving information about input/output (I/O) requests associated with injection of data into a process. The logic/module can generate or update an information log to reflect that the process includes data from an external source. The data from the external source can include fileless malware. The technique also includes the logic/module intercepting an execution request by a process (e.g., the process that includes data from an external source, another process, etc.), where an execute privilege located in an operating system mediated access control mechanism approves the request. Next, the logic/module determines that the process requesting execution is included in the log and removes an execute privilege located in a hypervisor mediated access control mechanism to deny the request. Other advantages and embodiments are described.