Malware Scanner Isolation via Hypervisor Virtual Containers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-malware software is vulnerable to attacks due to its broad access to various data types and high processor privileges, making it a preferred target for malware, and existing solutions lack effective isolation mechanisms to contain potential attacks.
Innovation Solution
The use of hardware virtualization technology to create isolated memory domains for malware scanners within virtual containers, allowing them to operate independently of the guest virtual machine's memory domain, with the hypervisor managing memory context switching and interrupt handling to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anti-malware software executes with high processor privileges and accesses broad ranges of file and data types, then malware detection capability is improved, but vulnerability to malware attacks increases
Solution Approach 1:
The system segments the anti-malware software into two distinct virtual machine environments: a first VM for scanning operations and a second VM for target object execution. This segmentation isolates the high-privilege scanning activities from the target system, allowing comprehensive file and data type access for detection while containing potential attack vectors within the first VM's isolated environment.
Solution Approach 2:
The patent introduces a hypervisor as an intermediary layer between the anti-malware scanner and the target operating system. The hypervisor manages virtualized hardware resources and controls memory access, enabling the scanner to operate with elevated privileges while the target OS remains protected. The hypervisor acts as a mediator that allows necessary access for detection while preventing direct attack propagation.
2Reliability
If hardware virtualization technology is used to create isolated memory domains, then security against malware attacks is improved, but system complexity increases
Solution Approach 1:
The patent employs a hypervisor that provides multiple functions: it manages memory domains for isolation, virtualizes hardware resources, controls context switching between VMs, and handles interrupt redirection. By consolidating these diverse functions into a single hypervisor component, the system achieves strong security isolation without proportionally increasing overall system complexity.
Data Source
AI summary
Described systems and methods allow protecting a host system, such as a computer or smartphone, from malware. In some embodiments, an anti-malware application installs a hypervisor, which displaces an operating system executing on the host system to a guest virtual machine (VM). The hypervisor further creates a set of virtual containers (VC), by setting up a memory domain for each VC, isolated from the memory domain of the guest VM. The hypervisor then maps a memory image of a malware scanner to each VC. When a target object is selected for scanning, the anti-malware application launches the malware scanner. Upon intercepting the launch, the hypervisor switches the memory context of the malware scanner to the memory domain of a selected VC, for the duration of the scan. Thus, malware scanning is performed within an isolated environment.