Virtual Network Driver Malicious Activity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual function drivers in network computing devices are susceptible to malicious activity, such as malformed network packets, which can lead to repeated resets and performance issues, including lock-ups, due to inadequate detection and management of disruptive packets.
Innovation Solution
Implementing a system that tracks malicious activity through counters and compares them to thresholds, allowing for controlled resets or removal of virtual machines associated with malicious activity, and notifying administrators when thresholds are violated, thereby preventing lock-ups and maintaining network stability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the virtual function driver resets in response to detecting malicious activity, then the immediate malicious packet is blocked, but repeated resets cause performance degradation and network lock-ups
Solution Approach 1:
The system performs preliminary action by tracking malicious events before they cause repeated resets. Counters are maintained to detect patterns of malicious activity in advance, allowing the system to take preventive measures (such as isolating the virtual machine) before the driver enters a reset loop that would degrade performance
Solution Approach 2:
The system implements feedback by continuously monitoring the counter values that track malicious events. When counters indicate a pattern of malicious activity, the system responds by isolating the affected virtual machine, creating a closed-loop control system that adjusts network isolation based on real-time threat detection
2Reliability
If the system tracks and monitors malicious activity with counters and thresholds, then malicious patterns can be detected, but system complexity increases
Solution Approach 1:
The system applies self-service by using the existing network traffic and event data that already flows through the virtual function driver. The counters are populated automatically from normal driver operations and malicious event detections, eliminating the need for separate data collection infrastructure
Solution Approach 2:
The system changes parameters by using simple counter values and threshold comparisons rather than complex analysis algorithms. The malicious activity detection is reduced to monitoring whether counter values exceed predetermined thresholds, transforming a potentially complex detection problem into simple parameter comparison
Data Source
AI summary
Technologies for handling malicious activity of a virtual network driver include a network computing device on which a virtual machine is being executed and the virtual network driver is managing communication between the physical network interface controller and the virtual function network adapter. The network computing device is configured to monitor events handled by the virtual network driver to detect malicious activity and update one or more malicious event tracking variables corresponding to a type of malicious activity event detected. The network computing device is further configured to compare one or more of the malicious event tracking variables to a corresponding malicious event threshold and perform an action on the virtual function driver in response to a determination that one or more of the malicious event tracking variables indicates that the corresponding malicious event threshold has been violated. Other embodiments are described and claimed herein.