Virtual Machine Introspection Semantic Layer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for analyzing virtual machine behavior in cloud computing environments face challenges in interpreting low-level data from the hypervisor level into semantically significant information for human operators, known as the semantic gap, and require multiple secure virtual machines for different operating systems, leading to complexity and performance issues.
Innovation Solution
A method that constructs a correspondence table associating memory addresses with kernel function prototypes, allowing for high-level interface access through the hypervisor, independent of operating systems, using digests of kernel function instructions compared to reference digests in a database, and supports learning phases for new operating systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If virtual machine introspection is implemented at the hypervisor level to detect security problems, then complete visibility of hardware resource usage is achieved, but the semantic gap between raw data and meaningful virtual machine activity interpretation increases
Solution Approach 1:
The patent introduces a semantic layer as an intermediary between the hypervisor's raw data and human operators. This layer includes a vocabulary of virtual machine activities and a semantic network that maps low-level hypervisor events to high-level meaningful concepts, effectively bridging the semantic gap while preserving complete visibility of hardware resource usage
Solution Approach 2:
The patent replaces the manual interpretation process with an automated semantic analysis system. The system automatically maps raw hypervisor data to semantic concepts using algorithms and data structures, eliminating the need for human operators to manually interpret low-level data while maintaining measurement precision
2Adaptability or versatility
If multiple secure virtual machines are added to support different operating systems, then operating system independence is improved, but device complexity and management overhead increase
Solution Approach 1:
The patent creates a universal semantic layer that operates independently of specific operating systems. This layer provides a common interface and vocabulary that works across different operating systems, eliminating the need for multiple specialized secure virtual machines while maintaining adaptability to various OS environments
Solution Approach 2:
The patent merges the functionality of multiple operating-system-specific secure virtual machines into a single unified semantic layer. This consolidation reduces device complexity by eliminating redundant components while preserving the ability to support multiple operating systems through the universal interface
3Measurement precision
If secure virtual machines are added to bridge the semantic gap, then interpretation capability is improved, but performance of the virtualized environment deteriorates
Solution Approach 1:
The patent creates a virtual copy of the semantic layer that operates in parallel with the actual virtual machines. This copy captures and interprets virtual machine activities without requiring additional secure virtual machines, thereby maintaining interpretation capability while minimizing performance impact through non-intrusive observation
Solution Approach 2:
The patent implements selective semantic analysis that focuses only on the most relevant virtual machine activities rather than analyzing every single event. This partial action approach reduces the computational overhead of the semantic layer while still providing meaningful interpretation of critical virtual machine behaviors
Data Source
Figure 1
Figure 2
Figure 3~5
AI summary
The invention relates to a method for assisting with the analysis of the execution of at least one virtual machine hosted by a host server (10), the virtual machine comprising an operating system (OS1) communicating with a hypervisor (11) of the host system, said hypervisor interfacing between the operating system and hardware resources of the host system, said method comprising the following steps: a step (E10) in which the hypervisor identifies, in a memory zone associated with the virtual machine, a first instruction corresponding to an entry point of a current function of the virtual machine; a step (E11) in which a second instruction corresponding to the end of said current function is identified; a step (E12) in which a hash of the instructions contained between the first instruction and the second instruction of the current function is calculated; a step (E13) in which said hash is sought in a reference database (BDR), said database comprising a set of hashes of functions of the kernel of the operating system of the virtual machine, which hashes are respectively associated with a prototype of said function of the kernel; and, when said hash is found in the reference database, a step (E14) in which an address of the entry point of the current function is recorded in association with the prototype of the function of the kernel.