Virtualization Detection Engine for Dynamic Execution Environments

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Dynamic execution environments, such as JAVASCRIPT execution environments, lack definitive access to native, unmodified core runtime objects, making applications vulnerable to virtualization attacks where a malicious enclosing environment can present a modified runtime, leading to unexpected results or interference.

Innovation Solution

A system with a virtualization detection engine that compares baseline and current graph information of execution environment objects to detect virtualization activity, using a 'detectVirt()' function or similar mechanisms to validate object graph structures and functions, ensuring the application executes in a non-virtualized environment.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If dynamic execution environments provide reflection interfaces for applications to dynamically introspect and modify core system objects, then adaptability and versatility are improved, but reliability deteriorates due to vulnerability to virtualization attacks

Engineering Contradiction:

Improvedynamic modification capabilityVSAvoidsecurity against virtualization attacks

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs preliminary actions by capturing a baseline set of graph information representing the expected state of core system objects before any modifications occur. This baseline is stored and later used for comparison to detect virtualization attacks, allowing the system to maintain security while preserving dynamic modification capabilities.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback by continuously monitoring the actual state of core system objects through graph information capture and comparing it against the stored baseline. When discrepancies are detected indicating virtualization activity, the system can respond appropriately, creating a closed-loop security mechanism that maintains reliability without restricting adaptability.

Inventive Principle:

Principle #23Feedback

2Ease of operation

If a virtualizing enclosing environment presents an ostensibly unmodified execution environment to an application, then ease of operation is improved, but harmful factors increase due to unexpected results and interference

Engineering Contradiction:

Improveapparent execution environment stabilityVSAvoidvirtualization interference

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system introduces an intermediary detection mechanism that sits between the application and the execution environment. This intermediary captures graph information about core system objects and compares it against baselines, acting as a mediator that detects virtualization interference without disrupting the apparent stability of the execution environment for the application.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system replaces direct mechanical inspection of execution environment objects with a graph information-based detection mechanism. Instead of directly analyzing potentially compromised objects, the system uses graph representations and comparisons to indirectly detect virtualization activity, providing a more robust detection approach.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Reliability

If the system captures and compares graph information to detect virtualization activity, then reliability is improved, but device complexity increases

Engineering Contradiction:

Improvevirtualization detection accuracyVSAvoiddetection engine structure

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system uses copying by creating a baseline copy of the graph information representing core system objects in their expected state. This baseline copy is stored and later compared against actual graph information to detect virtualization attacks, providing a simple and effective detection mechanism without excessive complexity.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The detection system segments the monitoring process into distinct components: capturing baseline graph information, capturing current graph information, comparing the two sets, and detecting discrepancies. This segmentation makes the complex detection task more manageable and implementable while maintaining high reliability.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS9250940B2Virtualization detection

Publication Date: 2016.02.02 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

A baseline set of graph information associated with a predefined execution environment of a program may be obtained, the baseline set associated with a baseline time interval. The predefined execution environment includes predefined environment objects, at least a portion of which are dynamically mutatable. A second set of graph information associated with the predefined execution environment may be obtained, the second set associated with a second time interval that is later in time than the baseline time interval. The baseline set and the second set may be compared to detect virtualization activity associated with a dynamic runtime.