Virtual Memory Inspection for Passive Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualization platforms face challenges in providing secure threat detection due to invasive memory inspection methods that affect performance and are not acceptable in all environments, especially when multiple virtual machines increase the demand on system resources.
Innovation Solution
A system and method for passive threat detection using virtual memory inspection, where a synchronized copy of physical memory pages from a virtual guest machine is analyzed off-line for threats, allowing for near real-time monitoring with minimal impact on host processing, and includes a feedback loop for appropriate actions such as shutting down the virtual machine or alerting administrators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory inspection is performed on a virtual machine host to detect threats, then threat detection capability is improved, but host performance deteriorates due to invasive inspection methods
Solution Approach 1:
The patent creates a copy of the virtual machine's memory pages and inspects the copy instead of the original memory. This allows threat detection to be performed on a duplicate set of memory pages, eliminating the performance penalty of inspecting the live system while maintaining detection accuracy. The inspection engine analyzes the copied memory pages offline or in parallel, ensuring that the virtual machine host continues to operate at full performance.
2Productivity
If multiple virtual machines are deployed to increase computing capacity, then system productivity is improved, but security monitoring complexity increases
Solution Approach 1:
The patent implements a universal memory inspection framework that can monitor multiple virtual machines simultaneously through a single inspection engine. The system collects memory pages from multiple VMs and processes them through the same inspection pipeline, allowing security monitoring to scale with the number of virtual machines without proportionally increasing monitoring complexity. This multi-functional approach enables the same infrastructure to serve both computing and security monitoring purposes.
3Measurement precision
If invasive memory inspection is performed on a virtual machine host, then threat detection accuracy is improved, but system stability deteriorates
Solution Approach 1:
The patent performs memory page copying before inspection occurs, preparing the data set in advance so that the actual inspection process does not interfere with system stability. By pre-capturing the memory state and separating the copying operation from the inspection operation, the system can conduct thorough security analysis without destabilizing the running virtual machine host. This preliminary action ensures that the inspection process is decoupled from the system's operational stability.
Data Source
AI summary
A method in one example implementation includes synchronizing a first memory page set with a second memory page set of a virtual guest machine, inspecting the first memory page set off-line, and detecting a threat in the first memory page set. The method further includes taking an action based on the threat. In more specific embodiments, the method includes updating the first memory page set with a subset of the second memory page set at an expiration of a synchronization interval, where the subset of the second memory page set was modified during the synchronization interval. In other more specific embodiments, the second memory page set of the virtual guest machine represents non-persistent memory of the virtual guest machine. In yet other specific embodiments, the action includes at least one of shutting down the virtual guest machine and alerting an administrator.