VM Malware Protection via Filter Driver Write Streaming
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual machines are vulnerable to malware, and existing solutions lack real-time protection mechanisms to detect and prevent malware infections effectively.
Innovation Solution
A filter driver is installed in virtualized infrastructure managers to stream writes from virtual machines in real-time to a cluster, which monitors for malicious software, using a malware catalog and detection engine to identify and prevent malware infections before they occur.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If real-time monitoring of virtual machine writes is implemented to detect malware, then malware detection capability is improved, but system complexity increases due to the filter driver and streaming infrastructure
Solution Approach 1:
A filter driver is installed in the virtualized infrastructure manager to intercept and stream writes from virtual machines to a cluster for malware analysis. This intermediary component enables real-time monitoring without requiring direct access to VM internal processes, thus improving detection capability while managing system complexity through a dedicated mediation layer.
2Reliability
If malware detection and prevention mechanisms are implemented, then virtual machine security is improved, but processing time may increase due to real-time analysis requirements
Solution Approach 1:
The system streams writes to a cluster for analysis before the malware can execute or cause damage. By performing preliminary analysis on outgoing writes and preemptively blocking suspicious content, the system prevents malware infections before they occur, thereby improving security while minimizing actual processing delays through early detection.
3Measurement precision
If comprehensive malware scanning is performed on all writes, then detection accuracy is improved, but productivity decreases due to the overhead of real-time scanning
Solution Approach 1:
The filter driver streams writes to a cluster for analysis, focusing computational resources on analyzing suspicious or changing writes rather than uniformly scanning every byte. This partial action approach maintains high detection accuracy for malicious content while reducing overall processing overhead by prioritizing analysis based on risk indicators.
Data Source
AI summary
A computer-implemented method at a data management system comprises receiving, at the system, a write made to a virtual machine from a virtual machine host; computing, at the system, a fingerprint of the transmitted write; comparing, at the system, the computed fingerprint to malware fingerprints in a malware catalog; repeating the computing and comparing; and disabling the virtual machine if a number of matches from the comparing breaches a predetermined threshold over a predetermined amount of time.