VM Forensics via Hypervisor Snapshots
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current approaches to detecting and addressing malware in computing systems are inadequate, as they often fail to detect malware before infection, leading to system compromise and significant time and financial losses.
Innovation Solution
The implementation of a virtualized computing environment with multiple virtual machines, including a trusted VM0 for secure operations and untrusted UCVMs for handling potentially malicious code, where each process executes in its own VM, allowing for granular monitoring and isolation of deviant behavior, and the use of forensic tools for analysis and protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current malware detection approaches are used, then detection capability is limited, but system security and response time deteriorate leading to compromise and losses
Solution Approach 1:
The system performs preliminary actions by creating forensic snapshots of virtual machine states before malware can execute or propagate. The hypervisor captures memory, registry, and file system states proactively, allowing forensic analysis to occur on preserved data rather than requiring real-time detection during active infection, thus improving both detection reliability and response time.
Solution Approach 2:
The patent introduces an intermediary forensic analysis layer that operates between the virtualized environment and the physical system. Forensic tools analyze snapshots and logs generated by the hypervisor without interfering with normal system operations, enabling comprehensive malware detection while maintaining system performance and response time.
2Reliability
If virtual machine isolation is implemented for each process, then security and monitoring capability improve, but system complexity increases
Solution Approach 1:
The hypervisor serves multiple functions simultaneously: it virtualizes hardware resources, manages virtual machine lifecycles, generates forensic snapshots, and provides monitoring capabilities. This multi-functionality consolidates what would otherwise be separate complex systems into a single coordinated platform, improving security and monitoring while managing overall system complexity.
Solution Approach 2:
The system creates disposable virtual machine instances for isolated process execution and deliberately discards them after forensic analysis. This approach allows comprehensive monitoring and security analysis in each VM without permanently maintaining complex isolated environments, as resources are recovered and reused after the forensic purpose is fulfilled.
3Measurement precision
If forensic snapshots are captured for analysis, then detection accuracy improves, but system resources and time consumption increase
Solution Approach 1:
The system creates copies of virtual machine states (memory, registry, file system) through forensic snapshots rather than analyzing the live system continuously. These snapshots are precise replicas that can be analyzed offline without affecting real-time system performance, thereby improving detection accuracy while minimizing time consumption during actual system operation.
Solution Approach 2:
Forensic snapshots are captured periodically or at specific trigger events (process creation, file access) rather than continuously. This periodic action maintains high detection accuracy by capturing relevant system states while avoiding the resource overhead and time consumption of continuous monitoring and analysis.
Data Source
AI summary
The execution of a process within a virtual machine (VM) may be monitored, and when a trigger event occurs, additional monitoring is initiated, including storing behavior data describing the real-time events taking place inside the VM. This behavior data may then be compared to information about the expected behavior of that type of process in order to determine whether malware has compromised the VM. The trigger event may be analyzed in relation to a set of heuristics, and based on the analysis, a data collection process may be initiated wherein the data comprises information about events occurring in the first virtual machine.