Virtual Machine Malware Scanning via Shutdown Memory Preservation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems do not effectively scan virtual machines due to their short lifespan, leading to potential security issues that can be exploited across multiple instances, and they often impact virtual machine performance.
Innovation Solution
A method where a virtual machine monitor creates and manages virtual machines, performs tasks, detects shutdown indicators, preserves memory spaces, and triggers malware scans before shutting down, allowing for efficient malware detection without significantly impacting performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware scanning is performed on virtual machines, then security detection capability is improved, but virtual machine performance is degraded
Solution Approach 1:
The system performs malware scanning during the shutdown phase of virtual machines, which is a preliminary action taken after the virtual machine completes its task but before it is fully terminated. This allows security checks to be conducted without interfering with the virtual machine's operational performance during its active lifecycle.
Solution Approach 2:
Malware scanning is performed periodically on virtual machines as they cycle through their lifecycle (creation, operation, shutdown). The system sets hooks to detect shutdown indicators and triggers scans at these periodic intervals, ensuring security coverage without continuous performance impact.
2Productivity
If virtual machines are short-lived, then resource utilization is improved, but malware detection opportunity is reduced
Solution Approach 1:
The system takes preliminary action by scanning virtual machines during their shutdown phase, ensuring that malware detection occurs even though the virtual machine's operational lifespan is short. This captures the security check opportunity at the transition point before the virtual machine is terminated.
Solution Approach 2:
The shutdown phase serves as an intermediary period between the virtual machine's operational state and its termination. By performing malware scanning during this intermediary phase, the system exploits the brief window where the virtual machine is transitioning, allowing detection without extending the operational lifecycle.
3Reliability
If malware scanning is performed continuously, then detection coverage is improved, but system overhead is increased
Solution Approach 1:
Instead of continuous scanning, the system implements periodic scanning triggered by shutdown indicators. This reduces system overhead by limiting scans to specific moments in the virtual machine lifecycle while maintaining detection coverage across all virtual machines that pass through the shutdown phase.
Solution Approach 2:
The system performs scanning as a preliminary action during shutdown rather than continuously during operation. This timing strategy ensures detection coverage is maintained while minimizing the duration and intensity of scanning activities, thereby reducing overall system overhead.
Data Source
AI summary
Methods, systems, and computer program products for selecting a virtual machine to perform a task corresponding to a client request and performing the task at the virtual machine. After performing the task at the virtual machine, an indicator corresponding to a shutdown of the virtual machine is detected. After detecting the indicator and prior to the shutdown of the virtual machine, a memory space is preserved corresponding to the virtual machine. The preserved memory space is then scanned for malware.