Hypervisor-Based VM Network Process Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized computing environments, existing methods struggle to accurately and securely correlate network connections with Virtual Machine (VM) processes without relying on dedicated agents within the VMs, which can be insecure and complex, and often involve Deep Packet Inspection (DPI) or high computational complexity.
Innovation Solution
A method and system that utilize a hypervisor to monitor network connections and directly access memory regions of VMs to correlate network connections with VM processes, eliminating the need for agents within the VMs by reconstructing physical addresses and accessing data structures managed by the guest operating system, thereby providing agent-less correlation that is secure, fast, and computationally modest.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dedicated agents are deployed within VMs to correlate network connections with processes, then correlation accuracy is improved, but system security deteriorates and device complexity increases
Solution Approach 1:
The patent introduces the hypervisor as an intermediary layer between the network connections and VM processes. Instead of deploying agents directly within VMs (which compromises security), the hypervisor serves as a trusted mediator that can observe both network traffic and memory contents, enabling accurate correlation without compromising VM security boundaries.
Solution Approach 2:
The patent extracts the correlation functionality from within the VMs (where agents would be installed) and relocates it to the hypervisor layer. This extraction eliminates the security risks associated with in-VM agents while preserving the correlation capability by leveraging the hypervisor's privileged access to both network and memory.
2Measurement precision
If Deep Packet Inspection (DPI) is used to correlate network connections with VM processes, then correlation accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent extracts the correlation logic from complex packet inspection operations and replaces it with direct memory access. Instead of performing DPI to infer process information from network packets, the system directly reads process information from VM memory structures, dramatically reducing computational complexity while maintaining accuracy.
Solution Approach 2:
The patent replaces the mechanical process of packet inspection and analysis with a more efficient mechanism: direct memory access. Instead of mechanically inspecting each packet to determine which process generated it, the system directly queries the VM's memory structures where process information is already stored, eliminating the need for complex computational analysis.
3Extent of automation
If agents are installed within VMs for correlation, then correlation functionality is achieved, but ease of deployment deteriorates
Solution Approach 1:
The patent makes the hypervisor universal by enabling it to perform both its traditional resource virtualization function and the additional function of network-process correlation. This multi-functionality eliminates the need for separate agent software in each VM, simplifying deployment since the correlation capability is already present in the hypervisor that manages all VMs.
Solution Approach 2:
The patent enables the hypervisor to self-serve the correlation function without requiring external agents or additional software components within VMs. The hypervisor uses its inherent access to network connections and memory to perform correlation autonomously, eliminating deployment complexity associated with installing and configuring agents in each VM.
Data Source
AI summary
A method includes, in a computer, running a hypervisor that allocates resources of a memory and of a network to one or more Virtual Machines (VMs), which run VM processes and communicate over network connections. First information is extracted by monitoring the network connections in the hypervisor. Second information is extracted by directly accessing, in the hypervisor, regions of the memory assigned to the VMs. An association is established between a given network connection and a given VM process, by correlating the first information with the second information.