VM Event Filter Reduces Context Switches for Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In hardware virtualization platforms, the frequent suspend/resume cycles of virtual machines (VMs) due to security events lead to substantial computational costs, affecting productivity and user experience, as conventional anti-malware systems require hardware processor switches between the VM and security software outside the VM.
Innovation Solution
A host system configuration with a hardware processor executing a virtual machine, an event filter within the VM, and an introspection engine outside the VM, which generates exceptions and determines event eligibility to selectively switch between the event filter and introspection engine, reducing unnecessary VM exits and computational overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-malware systems switch between VM and security software outside VM for security events, then security protection is ensured, but computational cost increases and productivity decreases
Solution Approach 1:
The security system is segmented into two components: an event filter executing inside the VM and an introspection engine executing outside the VM. This segmentation allows the system to handle security events differently based on their nature, filtering out benign events inside the VM while maintaining the ability to analyze suspicious events outside the VM, thus reducing unnecessary context switches and improving computational efficiency
Solution Approach 2:
The event filter acts as an intermediary between the software entity inside the VM and the introspection engine outside the VM. It receives security events, determines their eligibility for notification, and only passes suspicious events to the introspection engine. This intermediary role reduces the frequency of VM exits and context switches, thereby improving productivity while maintaining security protection
2Reliability
If frequent VM suspend/resume cycles occur for security event analysis, then security monitoring is maintained, but user experience and productivity are affected
Solution Approach 1:
The event filter applies partial action by selectively notifying the introspection engine only for eligible security events that meet certain criteria. Benign events are filtered out and handled without triggering VM suspend/resume cycles. This partial notification approach maintains security monitoring for suspicious events while avoiding unnecessary context switches for normal events, thus reducing productivity loss
Solution Approach 2:
The event filter performs self-service by autonomously determining the eligibility of security events and handling benign events without external intervention. It only invokes the introspection engine when necessary, allowing the system to self-manage security events efficiently and minimize disruptions to VM execution and user productivity
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
Described systems and methods allow protecting a hardware virtualization system from malicious software. Some embodiments use a hybrid event notification/analysis system, wherein a first component executing within a protected virtual machine (VM) registers as a handler for processor exceptions triggered by violations of memory access permissions, and wherein a second component executing outside the respective VM registers as a handler for VM exit events. The first component filters permission violation events according to a set of rules and only notifies the second component about events which are deemed relevant to security. The second component analyzes notified events to detect malicious software.