Virtual Machine Raw Scan for Host Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for detecting malware with anti-access technology, such as Rootkits, are ineffective as they can be evaded by advanced malware and often require interrupting user activity or rebooting the operating system, making them inconvenient and unreliable.
Innovation Solution
Implementing a virtual machine that remaps files and memory to its guest space to perform a raw scan, allowing detection of malware without interrupting the host OS or requiring a reboot, using virtualization technology to isolate the scanning process from evasive malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus scanning methods are used, then the scan engine can operate at the same level as the malware, but the scan engine can be fooled by advanced malware with anti-access technology
Solution Approach 1:
The patent introduces a virtual machine dimension between the host OS and the scanner, creating a new operational layer. The scanner runs inside the VM while the VM runs on the host OS, allowing the scan engine to access host memory and files through virtualization without being at the same level as the malware. This dimensional separation enables the scanner to bypass malware hooks and anti-access technology that operate at the host OS level.
Solution Approach 2:
The virtual machine acts as an intermediary between the scan engine and the host system. The VM provides virtualized access to host memory and files, mediating all interactions between the scanner and the potentially infected host environment. This intermediary layer prevents malware from directly interfering with the scan engine while still allowing the scanner to examine host resources.
2Reliability
If a second OS mechanism is used to detect malware, then the scan engine cannot be interrupted by malicious code, but user activity must be interrupted and a reboot is required
Solution Approach 1:
The virtual machine is pre-configured with all necessary scanning capabilities and virtualized access to host resources before the scan begins. The VM includes pre-loaded scan engines, memory access interfaces, and file system virtualization components, eliminating the need for rebooting or interrupting user activity during the scan process.
Solution Approach 2:
The virtual machine serves multiple functions simultaneously: it provides an isolated execution environment for the scan engine, virtualizes access to host memory and files, and allows the scan to proceed without interrupting the host OS. This multi-functionality eliminates the need for a separate second OS while maintaining detection integrity.
3Measurement precision
If kernel mode scanning is used, then the scan engine can access system resources, but advanced malware can also gain control in kernel mode and hijack the execution path
Solution Approach 1:
The patent moves the scan engine from the host OS kernel level to a virtualized environment dimension. Instead of operating at ring 0 on the host, the scanner runs inside a VM that virtualizes access to kernel resources. This dimensional shift allows the scanner to access system resources through virtualization interfaces rather than direct kernel mode operations, preventing malware from hijacking the execution path.
Solution Approach 2:
The virtual machine acts as an intermediary layer between the scan engine and the host kernel. The VM provides virtualized access to memory, files, and system resources, mediating all interactions between the scanner and the host OS kernel. This prevents malware running in kernel mode on the host from directly interfering with the scan engine's execution path.
Data Source
AI summary
A virtual machine is used to perform a raw scan for evasive malware on a host computer without requiring an interrupt or restart of a host operating system. An antivirus program installs a raw scanner virtual machine. The raw scanner virtual machine is triggered to scan files and memory for malware. The raw scan results are collected by the antivirus program for analysis, such as for use in generating a report or for removal of malware. The memory and files of the host are mapped to a guest space of the virtual machine.