Volatile Memory Acquisition via Live Migration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for capturing volatile memory of an execution environment often inadvertently alert malware, allowing it to evade detection by purging or obfuscating itself, and may also affect the memory content during capture.
Innovation Solution
The use of live migration of an execution environment to capture a memory image at a migration target, allowing for continued execution at the original host without indicating the capture to processes, thereby minimizing the chance for malware to adapt and evade detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional memory capture methods are used, then memory can be captured for analysis, but malware may be alerted and eliminate or obfuscate itself
Solution Approach 1:
The patent uses virtualization technology as an intermediary layer between the malware and the memory capture process. By capturing memory at the virtualization layer rather than through traditional guest OS methods, the system obtains memory images without the malware being aware of the capture operation, thus preventing self-elimination or obfuscation while maintaining capture accuracy
Solution Approach 2:
The patent segments the memory capture process into two independent phases: (1) creating a memory image through virtualization without alerting the malware, and (2) analyzing the captured image separately. This segmentation allows the capture operation to proceed without triggering malware defenses, while analysis can be performed on the isolated image
2Loss of information
If memory capture operations are performed, then forensic analysis can be conducted, but the capture process may affect memory content
Solution Approach 1:
The patent performs preliminary actions by creating a complete memory image through the virtualization layer before any analysis operations begin. This preliminary capture preserves the exact state of memory at a specific point in time, ensuring that subsequent analysis does not affect the original memory content and maintaining both integrity and precision
Data Source
AI summary
Aspects of the present disclosure relate to volatile memory acquisition using live migration of an execution environment. In examples, a virtualization manager controls execution of an execution environment at a virtualization host. The virtualization manager may enable live migration of the execution environment, such that the execution environment may be migrated to another virtualization host (or “migration target”) for continued execution. Accordingly, such functionality may be used to capture a memory image at a migration target, after which the execution environment continues executing at the original virtualization host. The memory image may be analyzed to identify the presence of malware and/or to generate a list of processes that were executing at the time of the capture. Such aspects may enable capturing a substantially accurate and consistent memory image of the volatile memory of the execution environment without indicating, inadvertently or otherwise, that a capture is occurring to processes executing therein.