Offline Virtual Machine Image Scanning for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtual machine environments, the transient nature and large number of virtual machines make it difficult to identify and remove malware, leading to persistent infections due to the challenges of managing individual malware applications and the resource-intensive scanning process, which can be exacerbated by malware hiding from antimalware programs running within the operating system.
Innovation Solution
Storing virtual machine images as virtual hard disk files, allowing for offline scanning by exposing them as physical hard disks, and using an anti-malware engine to scan the file-system data, which can iteratively scan checkpoints to identify the last safe image and facilitate effective malware removal.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If individual malware applications are deployed per virtual machine, then malware detection capability is improved, but device complexity and resource consumption increase significantly
Solution Approach 1:
The patent merges multiple individual malware scanning operations into a single centralized scanning operation. Instead of deploying separate malware applications in each virtual machine, the system consolidates scanning functionality at the hypervisor level, allowing one scan to cover multiple virtual machines simultaneously. This reduces management complexity while maintaining comprehensive malware detection capability across the virtualized environment.
Solution Approach 2:
The patent implements a universal scanning mechanism that can scan multiple virtual machine images from a single location. The centralized malware scanning system performs multi-functionality by scanning different virtual machines, different file types, and different checkpoints through a unified interface, eliminating the need for separate scanning operations for each virtual machine and reducing overall system complexity.
2Ease of operation
If virtual machines are scanned while running, then scanning can be performed online, but malware can hide from detection and resource consumption increases
Solution Approach 1:
The patent takes preliminary action by creating a checkpoint or snapshot of the virtual machine state before scanning. This allows the scanning process to examine a static copy of the virtual machine's file system without interference from running processes. The checkpoint captures the state at a specific point in time, enabling thorough scanning while the virtual machine continues to run, thus maintaining both online capability and detection accuracy.
Solution Approach 2:
The patent introduces an intermediary mechanism (checkpoint/snapshot) between the running virtual machine and the scanning process. This intermediary allows the scanner to access a frozen copy of the virtual machine's state without directly interfering with the running system. The checkpoint acts as a buffer that enables accurate scanning while maintaining the virtual machine's operational status, resolving the conflict between online scanning and detection accuracy.
3Productivity
If virtual machines are rapidly deployed and taken offline, then scalability is improved, but malware persistence increases
Solution Approach 1:
The patent applies preliminary action by automatically scanning virtual machine images at deployment checkpoints or before bringing them online. This proactive scanning approach ensures that rapidly deployed virtual machines are checked for malware before they can potentially infect the network. The system performs scanning as a preliminary step in the deployment workflow, maintaining fast deployment speeds while ensuring malware detection and removal effectiveness.
Solution Approach 2:
The patent implements feedback mechanisms that track the deployment and scanning status of virtual machines. When virtual machines are rapidly deployed, the system receives feedback about their creation and automatically initiates scanning workflows. This feedback loop ensures that even in high-speed deployment scenarios, each virtual machine undergoes appropriate security checks, maintaining reliability without sacrificing productivity.
Data Source
AI summary
Methods and systems for scanning a virtual machine image. The virtual machine image may be stored as a collection of one or more virtual hard disk files. The virtual machine image may be stored by taking the virtual machine off-line or may be stored by taking a checkpoint of the virtual machine while the virtual machine is on-line. The virtual machine image is rendered to file-system data. Rendering the virtual machine image to file-system data may comprise mounting the virtual machine image's virtual hard disk drives. An anti-malware engine is invoked to scan the exposed file-system data, and data indicative of the scanning may be stored.