Hypervisor-Based Virtual Machine Monitoring for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualization environments, monitoring executable files and collecting malicious code is challenging due to interference from malicious code, which can terminate security programs and hide its existence, making it difficult to investigate incidents effectively.
Innovation Solution
A method and apparatus for monitoring virtual machines based on a hypervisor, which extracts system call transfer factors to detect access attempts, acquire execution paths, and check for malicious code without installing additional security programs, allowing for continuous monitoring and automatic collection of malicious files even if the virtual machine OS kernel is hijacked.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a security agent is installed in the host OS kernel or user area to monitor executable files, then monitoring capability is provided, but malicious code can interfere with or terminate the monitoring task since the security agent operates with the same authority as malicious code
Solution Approach 1:
The patent moves the monitoring function from the guest OS level (where security agents operate) to the hypervisor level (another dimension of system architecture). The hypervisor, being the virtualization layer above the guest OS, provides a higher authority position that allows monitoring without being subject to the same limitations as guest-level security agents. This dimensional shift enables reliable monitoring even when the guest OS kernel is compromised.
Solution Approach 2:
The hypervisor acts as an intermediary between the malicious code in the guest OS and the monitoring system. By implementing the monitoring apparatus at the hypervisor level, the system mediates access to executable files and system calls, allowing observation of malicious behavior without being directly targeted by it. The hypervisor's intermediate position protects the monitoring function from interference while maintaining visibility into guest OS activities.
2Ease of operation
If monitoring is performed at the guest OS level, then security tasks can be performed, but malicious code can hide its existence or delete itself to avoid detection
Solution Approach 1:
The hypervisor-level monitoring system performs preliminary action by capturing and preserving evidence of malicious code execution before the malicious code can delete itself or hide. The system monitors system calls and file access patterns at the hypervisor level, allowing it to detect and record malicious behavior in real-time. Evidence such as executable file paths, system call sequences, and process information is collected and stored before the guest OS can interfere with or destroy it.
Solution Approach 2:
The hypervisor serves as an intermediary that prevents malicious code from directly accessing or destroying monitoring evidence. By operating at a higher architectural level, the hypervisor intercepts and records system calls and file operations before the malicious code can execute deletion commands. This intermediary position ensures that evidence is preserved in a protected location that malicious code in the guest OS cannot reach or corrupt.
3Measurement precision
If additional security programs are installed in the virtual machine to monitor executable files, then monitoring capability is enhanced, but the device complexity and resource overhead increase
Solution Approach 1:
The hypervisor-level monitoring apparatus provides universal monitoring capabilities that replace the need for multiple guest-level security programs. A single monitoring system implemented at the hypervisor level can observe all executable files and system calls across multiple virtual machines, providing comprehensive coverage without the complexity of deploying and managing separate security agents in each VM. The hypervisor's multi-functional design allows it to perform both virtualization and security monitoring roles simultaneously.
Solution Approach 2:
The patent extracts the monitoring function from the guest OS environment and places it in the hypervisor environment. By taking out the security monitoring capability from the vulnerable guest OS layer and relocating it to the more secure hypervisor layer, the system achieves monitoring precision without requiring additional security programs within each virtual machine. This extraction eliminates the need for complex guest-level security architectures while maintaining or enhancing monitoring effectiveness.
Data Source
AI summary
An apparatus and method for monitoring a virtual machine based on a hypervisor. The method for monitoring a virtual machine based on a hypervisor includes monitoring an attempt to access an executable file located in a virtual machine, when the attempt to access the executable file is detected, extracting a system call transfer factor, input through a task that attempted to make access, acquiring, based on the system call transfer factor, an execution path corresponding to the executable file and a reference path corresponding to a reference file that is executed together with the executable file, and checking based on the execution path and the reference path whether any of the executable file and the reference file is malicious, and collecting a file in which malicious code is present when the malicious code is present in any of the executable file and the reference file.