Hypervisor Malware Detection via Memory Introspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware systems in virtualized environments face challenges in effectively detecting and protecting against malware, particularly rootkits that operate at the operating system privilege level, as they can subvert conventional security measures.
Innovation Solution
A system comprising a hypervisor, a process evaluator within the virtual machine, a memory introspection engine outside the virtual machine, and a process-scoring module that intercepts and evaluates system calls and memory access to determine malicious activity, using indicators from both within and outside the virtual machine to assess processes for malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-malware systems operate at the operating system privilege level, then they can access system resources and detect malware, but they can be subverted by rootkits that operate at the same privilege level
Solution Approach 1:
The patent moves the anti-malware detection system from the operating system privilege level to the hypervisor privilege level, which is a higher dimension in the system hierarchy. This dimensional change allows the security system to operate above rootkits and other OS-level malware, preventing subversion while maintaining detection capabilities through virtualized resource access.
Solution Approach 2:
The hypervisor acts as an intermediary between the anti-malware system and the virtualized hardware resources. By inserting this intermediate layer, the system can intercept and monitor system calls, memory access, and device operations without being vulnerable to OS-level malware, as the hypervisor mediates all access to underlying hardware.
2Productivity
If multiple virtual machines share hardware resources, then investment and operating costs are reduced, but each virtual machine requires separate malware protection
Solution Approach 1:
The hypervisor-based security system provides universal protection across multiple virtual machines through a single unified architecture. The same hypervisor layer that manages hardware resource sharing also provides malware detection and prevention for all VMs, eliminating the need for separate security systems in each VM and reducing overall complexity.
Solution Approach 2:
The patent combines the virtualization management functions and security protection functions into a single integrated hypervisor layer. This merging of functions allows the system to provide both resource sharing and malware protection simultaneously, reducing the number of separate components needed and simplifying the overall system architecture.
3Productivity
If a hypervisor is introduced to enable virtualization, then resource sharing and cost reduction are achieved, but the system requires additional security layers to protect against malware
Solution Approach 1:
The hypervisor is designed to perform both virtualization management and security protection functions universally across all virtual machines. This multi-functionality means that the same core component provides both resource sharing capabilities and malware detection, rather than requiring separate security layers added on top of the virtualization infrastructure.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
Described systems and methods allow protecting a computer system from malware, such as viruses and rootkits. An anti-malware component executes within a virtual machine (VM) exposed by a hypervisor executing on the computer system. A memory introspection engine executes outside the virtual machine, at the processor privilege level of the hypervisor, and protects a process executing within the virtual machine by write-protecting a memory page of the respective process. By combining anti-malware components executing inside and outside the respective VM, some embodiments of the present invention may use the abundance of behavioral data that inside- VM components have access to, while protecting the integrity of such components from outside the respective VM.