Hypervisor Security Analysis Reduces VCI Load
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for security analysis in software-defined data centers face challenges such as excessive processing resource usage on virtual computing instances (VCIs) and excessive network traffic due to the inability to perform cross-VCI analysis and the inefficiency of sending all events to a remote analysis component.
Innovation Solution
Implementing hypervisor-assisted security analysis, where events from VCIs are analyzed by a hypervisor, allowing for cross-VCI analysis and reducing network traffic by compressing and sending only relevant data to a remote analysis component.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If events are analyzed within the VCI itself, then security analysis can be performed, but processing resources of the VCI are excessively consumed
Solution Approach 1:
The patent introduces a hypervisor as an intermediary layer between the VCI and the security analysis system. The hypervisor collects events from the VCI and performs security analysis, thereby protecting the VCI from excessive processing resource consumption while maintaining security analysis capability. This mediator approach allows security functions to be offloaded from the guest OS to the hypervisor layer.
2Adaptability or versatility
If all events from VCIs are sent to a remote analysis component, then cross-VCI analysis is enabled, but network traffic becomes excessive causing congestion
Solution Approach 1:
The patent extracts and removes redundant information from events before transmission. The hypervisor performs preliminary filtering and aggregation of events, extracting only the essential security-relevant data needed for cross-VCI analysis. This reduces the volume of network traffic while preserving the capability to detect cross-VCI security patterns.
Solution Approach 2:
The patent segments the security analysis function into two parts: local event collection and filtering at the hypervisor level, and remote analysis of aggregated data. This segmentation allows cross-VCI analysis to be performed on a reduced data set, decreasing network traffic while maintaining the ability to detect security issues across multiple VCIs.
3Extent of automation
If all events are sent to a remote analysis component, then centralized security analysis is achieved, but detection time increases
Solution Approach 1:
The patent applies preliminary action by performing event filtering, aggregation, and preliminary analysis at the hypervisor level before events are sent to the remote analysis component. This preliminary processing reduces the time events spend in transit and queueing at the remote system, enabling faster overall detection while maintaining centralized analysis capabilities.
Solution Approach 2:
The patent segments the analysis timeline into immediate local processing at the hypervisor and subsequent remote analysis. Critical time-sensitive operations are performed locally, while less time-critical analysis is performed remotely, thereby reducing overall detection time while maintaining centralized security management.
Data Source
AI summary
The disclosure provides an approach for hypervisor-assisted security analysis. Embodiments include receiving, at a hypervisor on a host computer, events from one or more virtual computing instances (VCIs). Embodiments include analyzing, by the hypervisor, the events according to one or more rules to identify a subset of the events for additional analysis. Embodiments include compressing, by the hypervisor, the subset of the events by performing deduplication to produce a compressed subset of the events. Embodiments include transmitting, by the hypervisor, the compressed subset of the events over a network to a separate analysis component, wherein the separate analysis component performs the additional analysis.