Virtual Machine Boot Audit Trail Collection via Interrupt Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security technologies, such as anti-virus solutions and host-based intrusion detection systems, struggle to detect bootkits during the boot process due to their ability to bypass detection methods and operate before system booting is complete, and current virtual machine introspection (VMI) solutions are limited in monitoring threats within the virtual machine.
Innovation Solution
An apparatus and method for collecting an audit trail in a virtual machine boot process that includes an event detection unit, register state information extraction, monitoring of vector value changes, and threat occurrence detection within the hypervisor area, allowing for the identification and recording of threats during the boot process, including disk read interrupts and bootloader call information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection scheme is used, then detection accuracy for known bootkits is improved, but detection capability for new bootkits with unknown binary values deteriorates
Solution Approach 1:
The patent performs preliminary analysis of bootloader call sequences and disk access patterns during the boot process before the bootkit can execute its malicious payload. By capturing and analyzing the initial boot sequence information in advance, the system establishes a baseline for detecting anomalies without requiring signature databases, thus enabling detection of both known and new bootkits.
Solution Approach 2:
The patent introduces an intermediary analysis layer that monitors disk read interrupts and bootloader calls between the bootkit and the operating system. This intermediary layer captures indirect evidence of bootkit activity through abnormal access patterns and call sequences, allowing detection without direct confrontation that would trigger bootkit bypass mechanisms.
2Reliability
If behavior-based detection scheme is used, then detection of malicious bootloader modification is improved, but detection of carefully manufactured bootkits that discover detection logic deteriorates
Solution Approach 1:
The patent segments the boot process into distinct phases and monitors specific events (disk read interrupts, bootloader calls, interrupt vector table changes) independently. By dividing the detection task into multiple granular observation points, the system can identify subtle anomalies in each segment without requiring the bootkit to bypass the entire detection system at once.
Solution Approach 2:
The patent implements feedback mechanisms that continuously monitor boot process events and compare them against expected behavior patterns. When deviations are detected in disk access sequences or bootloader call patterns, the system adjusts its monitoring focus and captures additional evidence, creating a dynamic detection approach that adapts to sophisticated bootkit behaviors.
3Loss of information
If detection is performed after system booting is completed, then comprehensive system state information is available, but detection of bootkit behavior during boot process deteriorates
Solution Approach 1:
The patent performs detection actions preliminarily during the boot process itself by monitoring disk read interrupts and bootloader calls in real-time. Rather than waiting for boot completion, the system captures threat evidence as it occurs in the early boot stages, preventing loss of critical temporal information about bootkit behavior.
Solution Approach 2:
The patent uses disk read interrupts and bootloader call events as intermediary indicators that provide both temporal information about boot process state and evidence of malicious activity. These intermediaries allow the system to detect threats during booting while still gathering comprehensive information about system state through the sequence and pattern of events.
4Reliability
If VMI technology is used, then detection bypass function of bootkit is overcome, but monitoring capability for threats during boot process deteriorates
Solution Approach 1:
The patent extracts specific monitoring functions (disk read interrupt detection, bootloader call monitoring) from the general VMI framework and implements them as dedicated early-boot detection mechanisms. By separating these critical monitoring tasks from the broader VMI system, the patent ensures they operate with sufficient priority and granularity during the time-critical boot process while maintaining VMI's protection against bootkit bypass.
Data Source
AI summary
An apparatus and method for collecting an audit trail in a virtual machine boot process, the audit-trail-collecting apparatus including an event detection unit for detecting a software interrupt event, a register state information extraction unit for extracting state information of a CPU register corresponding to a detection time of the software interrupt event, a monitoring unit for monitoring a change in a vector value corresponding to the software interrupt event in an interrupt vector table, a threat occurrence detection unit for detecting a threat occurrence in a virtual machine boot process based on at least one of the CPU register state information and a monitored result, and an audit trail collection unit for storing an audit trail corresponding to at least one of the CPU register state information and the monitored result when the threat occurrence is detected in the virtual machine boot process.