VM Malware Detection via Transition Event Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems in virtual machines face challenges in accurately identifying malicious behaviors due to advanced malware detecting monitoring efforts, leading to false-negatives and false-positives, as they often rely on standard logic within the virtual machine or virtual machine monitor, which may not provide sufficient information for thorough analysis.
Innovation Solution
Implementing a malware detection system that uses permission switching of memory pages within virtual machines by injecting transition events at Points of Interest (POIs) and changing page permissions to 'execute only,' allowing for malware detection routines to be performed in the kernel space while remaining undetected by advanced malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If standard monitoring logic is used within the virtual machine to detect malware, then the detection process is simple to implement, but advanced malware can detect the monitoring and halt or alter instruction execution to remain undetected
Solution Approach 1:
The patent introduces a Virtual Machine Monitor (VMM) as an intermediary layer between the malware and the detection system. The VMM operates at a higher privilege level (ring -1 or ring 0) and intercepts CPU instructions before they execute in the guest OS. This intermediary approach allows detection of malware behaviors without the malware being able to detect or interfere with the monitoring, as all execution flows through the VMM which can log and analyze instructions without exposing its detection logic to the guest environment.
2Measurement precision
If monitoring is performed from the virtual machine monitor (VMM), then sufficient information about VM state and process state is obtained for thorough analysis, but the system complexity increases
Solution Approach 1:
The VMM is designed to perform multiple functions simultaneously: it manages virtualization resources, executes guest OS instructions, and performs malware detection analysis. By making the VMM multi-functional, the patent avoids adding separate complex monitoring infrastructure. The same VMM infrastructure that is already required for virtualization is leveraged to provide detailed instruction-level monitoring and analysis capabilities, thereby obtaining complete information without proportionally increasing system complexity.
3Reliability
If the page permission is set to 'execute only' to prevent malware detection, then advanced malware cannot detect transition events and remain undetected, but the ability to analyze memory content is reduced
Solution Approach 1:
The system performs preliminary analysis of the memory page content before the permission is changed to 'execute only'. The VMM intercepts and logs instructions at the POIs before the page permission modification occurs. This preliminary action ensures that the detection system has already captured the necessary information about the malware's intended behavior at those locations, so even though the permission change prevents further memory reading, the analysis capability is preserved through the pre-captured data.
Data Source
AI summary
A non-transitory storage medium including instructions that are executable by one or more processors to perform operations including instrumenting a VM is shown. The VM is used to process an object to determine whether the object is associated with malware. Logic within the VM analyzes memory allocated for a process within the VM for a point of interest (POI), the POI being an address of one of a set predetermined instructions likely to be associated with malware. The VMM detects a memory violation during processing of the object and responsive to detecting the memory violation, injects a transition event at the POI on the page on which the POI is located in memory. Further, responsive to detecting an attempted execution of the transition event, the VMM (i) emulates an instruction located at the POI, and (ii) the logic within the VM performs one or more malware detection routines.