Selective virtualization for security threat detection

Patent metadata

Field	Value
Publication number	US-11294705-B1
Application number	US-201916572537-A
Country	US
Kind code	B1
Filing date	Sep 16, 2019
Priority date	Mar 31, 2015
Publication date	Apr 5, 2022
Grant date	Apr 5, 2022

Abstract

Selective virtualization of resources is provided, where the resources may be intercepted and services or the resources may be intercepted and redirected. Virtualization logic monitors for one or more activities that are performed in connection with one or more resources and conducted during processing of an object within the virtual machine. The first virtualization logic further selectively virtualizes resources associated with the one or more activities that are initiated during the processing of the object within the virtual machine by at least redirecting a first request of a plurality of requests to a different resource than requesting by a monitored activity of the one or more activities.

First claim

What is claimed is:

1. A platform comprising:
one or more hardware processors; and
a memory coupled to the one or more processors, the memory comprises one or more virtual machines that are configured to process of an object under analysis and a virtual machine monitor that manages operability of the one or more virtual machines and is configured to detect and control handling of requests initiated by the one or more virtual machines,
wherein the virtual machine monitor comprises
a first logic configured to (i) temporarily halt execution of a first virtual machine of the one or more virtual machines in response to detecting a request from the first virtual machine and (ii) maintain an instruction pointer at a first virtual memory address associated with the request,
a second logic configured to (i) determine whether the request is associated with a virtualized resource and (ii) select a virtualization scheme for producing virtualized data, wherein the virtualization scheme being selected from (a) intercepting and redirecting the request to a different portion of system code than originally targeted when the request is directed to a first subset of activities and (b) intercepting and servicing the request when the request is directed to a second subset of activities, and
a third logic in communication with the second logic, the third logic to determine a memory location within the memory for placement of the virtualized data and to subsequently modify the instruction pointer to a second virtual memory address so that, when the first virtual machine resumes execution, the request has been serviced.

2. The platform of claim 1 , wherein the virtual machine monitor corresponds to a type 1 hypervisor that runs directly on a hardware of the platform including the one or more hardware processors.

3. The platform of claim 1 , wherein the virtual machine monitor corresponds to a type 2 hypervisor that runs directly on a host operating system of the platform.

4. The platform of claim 1 , wherein the first logic includes virtual machine monitor (VMM) management logic.

5. The platform of claim 4 , wherein the VMM management logic invokes and passes operation control to the second logic operating as intercept logic.

6. The platform of claim 1 , wherein the second logic operating as an intercept logic accesses data to determine whether the request is associated with a prescribed interception point.

7. The platform of claim 6 , wherein the prescribed interception point is a hook or a break point.

8. The platform of claim 6 , wherein the prescribed interception point is an Application Programming Interface (API) call.

9. The platform of claim 6 , wherein responsive to the request being associated with the prescribed interception point, the intercept logic is configured to access one or more usage patterns to determine criteria for conducting virtualization of a requested resource.

10. The platform of claim 1 , wherein the second logic servicing the request by at least returning virtualized data to a process or a thread operating within the virtual machine that initiated the request.

11. The platform of claim 1 , wherein the second logic redirecting the request by at least generating a modified request operating as the request by changing a resource associated with the request and subsequently passing the request to system code for processing.

12. A computerized method comprising:
processing of an object under analysis by one or more virtual machines;
managing operability of the one or more virtual machines by a virtual machine monitor to detect and control handling of requests initiated by the one or more virtual machines;
temporarily halting execution of a first virtual machine of the one or more virtual machines in response to detecting a request from the first virtual machine;
maintaining an instruction pointer at a first virtual memory address associated with the request;
determining whether the request is associated with a virtualized resource;
selecting a virtualization scheme for producing virtualized data when the request is associated with a virtualization resource, wherein the virtualization scheme being selected from (a) intercepting and redirecting the request to a different portion of system code than originally targeted when the request is directed to a first subset of activities and (b) intercepting and servicing the request when the request is directed to a second subset of activities; and
determining a memory location within a virtual memory for placement of the virtualized data and to subsequently modify the instruction pointer to a second virtual memory address so that, when the first virtual machine resumes execution, the request has been serviced.

13. The computerized method of claim 12 , wherein the temporarily halting of the execution of the first virtual machine, the maintaining of the instruction pointer, the determining whether the request is associated with the virtualized resource, the selecting of the virtualization scheme, and the determining of the memory location is conducted by a virtual machine monitor corresponds to a type 1 hypervisor that runs directly on hardware.

14. The computerized method of claim 12 , wherein the temporarily halting of the execution of the first virtual machine, the maintaining of the instruction pointer, the determining whether the request is associated with the virtualized resource, the selecting of the virtualization scheme, and the determining of the memory location is conducted by a virtual machine monitor corresponds to a type 2 hypervisor that runs directly on a host operating system.

15. The computerized method of claim 12 , wherein the temporarily halting of the execution of the first virtual machine and the maintaining of the instruction pointer is conducted by management logic of a virtual machine monitor (VMM).

16. The computerized method of claim 15 , wherein the VMM management logic invokes and passes operation control to intercept logic of the VMM, the intercept logic being configured to determine whether the request is associated with the virtualized resource and select of the virtualization scheme.

17. The computerized method of claim 16 , wherein the intercept logic accesses data to determine whether the request is associated with a prescribed interception point.

18. The computerized method of claim 17 , wherein the prescribed interception point is a hook or a break point.

19. The computerized method of claim 16 , wherein the prescribed interception point is an Application Programming Interface (API) call.

20. The computerized method of claim 12 , wherein the servicing of the request includes at least returning virtualized data to a process or a thread operating within the virtual machine that initiated the request.

21. The computerized method of claim 12 , wherein the redirecting of the request includes at least generating a modified request operating as the request by changing a resource associated with the request and subsequently passing the request to system code for processing.

Assignees

• Fireeye Inc
• Fireeye Security Holdings Us Llc

Inventors

• Paithane Sushant
• Vincent Michael

Classifications

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F2009/45562

  Creating, deleting, cloning virtual machine instances · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title