Nested Virtualization Memory Views for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security measures, including virtualization systems, struggle to effectively detect and prevent malware infections that exploit vulnerabilities in operating system data structures and processes, especially as malware becomes increasingly sophisticated and evades detection by altering resource states.
Innovation Solution
Implementing a virtualization layer with a micro-hypervisor and hyper-processes that create memory views using nested page tables, allowing for flexible and efficient assignment of guest processes to different memory views with varying protection profiles, enabling enhanced monitoring and access restrictions to detect and prevent malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtualization systems are used to provide enhanced security and malware detection, then security capability is improved, but device complexity increases
Solution Approach 1:
The patent implements nested virtualization by placing a micro-hypervisor inside a guest operating system running on a host hypervisor. This nested structure allows the inner micro-hypervisor to create isolated memory views for individual processes, enabling fine-grained security monitoring without requiring complete system redesign. The nested architecture resolves the contradiction by organizing complexity in hierarchical layers, where each layer provides specific security functions while maintaining overall system manageability.
Solution Approach 2:
The patent segments the virtualized environment by creating separate memory views for individual guest processes through the micro-hypervisor. Each process receives its own isolated memory view with controlled access permissions, separating security monitoring functions from the main guest OS. This segmentation allows security policies to be applied independently to each process, improving security capability while keeping the complexity localized and manageable through modular design.
2Measurement precision
If memory access is constrained through nested page tables to detect malware, then detection precision is improved, but processing speed decreases
Solution Approach 1:
The patent implements preliminary action by pre-configuring nested page tables with defined memory views and access permissions before guest processes execute. The micro-hypervisor establishes the nested paging structure and memory view boundaries in advance, so that during runtime, memory access constraints are already in place and do not require real-time computation. This pre-establishment of security boundaries maintains detection precision while minimizing runtime performance overhead.
Solution Approach 2:
The patent uses copying by creating virtual copies of page tables in the nested structure. The micro-hypervisor maintains shadow copies of the guest OS page tables with additional security metadata and access control information. These copied structures enable precise monitoring of memory accesses without requiring direct modification of the guest OS memory management, thereby maintaining detection precision while avoiding the performance penalty of real-time memory management intervention.
3Reliability
If multiple memory views are created for different guest processes, then security protection is improved, but device complexity increases
Solution Approach 1:
The patent implements universality by designing the nested page table structure to serve multiple functions simultaneously. The same nested paging mechanism provides both memory virtualization for process isolation and security enforcement through controlled memory views. The micro-hypervisor uses a unified approach to create and manage memory views for all guest processes, allowing the system to provide comprehensive security protection across multiple processes while managing complexity through a single, consistent memory management framework rather than separate mechanisms for each process.
Data Source
AI summary
A technique implements memory views using a virtualization layer of a virtualization architecture executing on a node of a network environment. The virtualization layer may include a user mode portion having hyper-processes and a kernel portion having a micro-hypervisor that cooperate to virtualize a guest operating system kernel within a virtual machine (VM) of the node. The micro-hypervisor may further cooperate with the hyper-processes, such as a guest monitor, of the virtualization layer to implement one or more memory views of the VM. As used herein, a memory view is illustratively a hardware resource (i.e., a set of nested page tables) used as a container (i.e., to constrain access to memory of the node) for one or more guest processes of the guest operating system kernel.