Virtual Machine Introspection via External Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious software in virtual machines are vulnerable to attacks, as in-system monitoring agents can be compromised, and manual updates of OS structure symbols leave systems exposed to vulnerabilities between updates.
Innovation Solution
Performing an offline analysis of the virtual machine's hard disk image using an introspection engine that accesses OS structure symbols from a symbol server, allowing for external detection of malicious software without relying on application programming interfaces, thereby bypassing potential tampering by malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If in-system monitoring agents are installed to detect malicious software, then detection capability is improved, but the agents themselves can be compromised by sophisticated malware
Solution Approach 1:
The patent introduces an external monitoring agent that operates outside the virtual machine as an intermediary to monitor the VM's memory space. This external agent cannot be compromised by malware running inside the VM, as it operates in a separate security context. The agent accesses VM memory through hypervisor-provided interfaces, enabling reliable detection of malicious software without the agent being vulnerable to in-VM attacks.
2Measurement precision
If manual updates of OS structure symbols are performed to maintain detection accuracy, then detection precision is improved, but systems remain vulnerable between updates
Solution Approach 1:
The patent implements continuous monitoring of the virtual machine's memory space by the external agent, which continuously compares observed memory structures against known malicious patterns. This continuous action ensures that detection precision is maintained without interruption, and the system remains protected at all times rather than having vulnerability windows between manual updates.
Solution Approach 2:
The monitoring system is designed to automatically detect and respond to malicious software without requiring manual intervention for updates or configuration. The external agent autonomously monitors memory, detects anomalies, and can trigger responses, eliminating the need for manual maintenance that creates vulnerability windows.
3Reliability
If in-system monitoring agents are used to protect against malware, then security monitoring is improved, but the presence of agents can be detected and their behavior altered by malware
Solution Approach 1:
By positioning the monitoring agent externally to the virtual machine, the patent creates a security intermediary that cannot have its behavior altered by malware running inside the VM. The agent monitors the VM through controlled interfaces provided by the hypervisor, ensuring that malware cannot detect, hide from, or alter the agent's behavior while maintaining effective security monitoring.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
Virtual machine introspection can include performing an offline analysis of a virtual machine hard disk image. Core operating system files associated with the operating system can be located during the offline analysis. Operating system structure symbols can be accessed from a symbol server based on the core operating system files. Introspection of the virtual machine can be performed using the accessed operating system structure symbols.