Hypervisor Memory Monitoring for Secure Active Protection
Solution Overview
Problem
Conventional computer security systems are vulnerable to malicious attacks as they can be disabled by malicious processes, and sophisticated attackers can bypass code execution hooks by executing intercepted functions without generating corresponding system events.
Innovation Solution
Implementing a system that monitors data structures in memory to infer system events, where a protection system executes on a separate partition from the computing device, using a hypervisor to intercept and analyze memory access requests, and generate object events to detect malicious activities, thereby preventing the protection system from being disabled by malicious code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the protection system is installed on the computing device to enable real-time monitoring, then the monitoring effectiveness is improved, but the system becomes vulnerable to being disabled by malicious processes with privileges
Solution Approach 1:
The system divides the computing environment into separate virtual machines: a guest VM containing the protected application and a host VM containing the protection system. This segmentation ensures that even if malicious code gains privileges in the guest VM, it cannot directly access or disable the protection system in the host VM, resolving the vulnerability while maintaining monitoring effectiveness.
Solution Approach 2:
The patent introduces a hypervisor as an intermediary layer between the guest VM and host VM. The hypervisor manages memory access requests and intercepts attempts to access the protection system's data structures, allowing the protection system to monitor guest VM activities without being directly exposed to malicious processes, thus maintaining both effectiveness and security.
2Measurement precision
If code execution hooks are used to intercept system events, then the detection capability is improved, but sophisticated attackers can bypass by executing functions without generating system events
Solution Approach 1:
The patent shifts the monitoring approach from intercepting system calls (one dimension) to monitoring memory access patterns (another dimension). By placing read-only memory pages containing data structures in the guest VM and monitoring access requests through the hypervisor, the system detects malicious activities based on memory access behavior rather than relying on system event generation, thereby bypassing sophisticated attack methods.
3Reliability
If the protection system monitors all system events on the computing device, then the security coverage is improved, but the system complexity and performance overhead increase
Solution Approach 1:
The patent extracts the protection system from the guest VM environment and places it in a separate host VM. This extraction allows the protection system to monitor guest VM activities through controlled memory access interception by the hypervisor, rather than implementing complex hooks throughout the guest OS, thereby reducing system complexity while maintaining comprehensive security coverage.
Data Source
AI summary
Technologies pertaining to detecting accesses to monitored regions of memory and transmitting data to a protection system responsive to the detecting are described herein. A region of memory that includes objects in an object graph utilized by an operating system to determine which processes to execute and an order to execute such processes is monitored. If a process executing on a processor attempts to write to an object in the object graph, a field that is being written to is identified, and a determination is made regarding whether the field includes a pointer. Based upon whether the field includes a pointer, a type of write desirably undertaken by the object is ascertained, and an object event is transmitted to the protection system that informs the protection system of the type of write.