Malware protection for virtual machines

Patent metadata

Field	Value
Publication number	US-11604876-B2
Application number	US-202016774661-A
Country	US
Kind code	B2
Filing date	Jan 28, 2020
Priority date	Jan 28, 2020
Publication date	Mar 14, 2023
Grant date	Mar 14, 2023

Abstract

A computer-implemented method at a data management system comprises: receiving, at a storage appliance from a server hosting a virtual machine, a write made to the virtual machine; computing, at the storage appliance, a fingerprint of the transmitted write; comparing, at the storage appliance, the computed fingerprint to malware fingerprints in a malware catalog; repeating the computing and comparing; and disabling the virtual machine if a number of matches from the comparing breaches a predetermined threshold over a predetermined amount of time.

First claim

The invention claimed is:

1. A data management system, comprising:
a storage appliance configured to store a snapshot of a virtual machine; and
one or more processors in communication with the storage appliance, the one or more processors configured to perform operations including:
receiving, at the storage appliance from a server hosting the virtual machine, a write made to the virtual machine;
computing, at the storage appliance, a fingerprint of the received write;
comparing, at the storage appliance, the computed fingerprint to malware fingerprints in a malware catalog while the virtual machine continues to receive writes;
repeating the computing and comparing for the continued received writes; and
disabling the virtual machine if a number of matches from the comparing breaches a predetermined threshold over a predetermined amount of time, the predetermined threshold greater than one.

2. The system of claim 1 , wherein the operations further include restoring the virtual machine using the snapshot stored in the storage appliance to a state before the predetermined threshold was breached.

3. The system of claim 1 , wherein the operations further include blocking writes from a source of the matches.

4. The system of claim 1 , wherein the operations further include generating the malware catalog including generating fingerprints of binaries and compressed binaries of known malware.

5. The system of claim 4 , wherein the fingerprints are computed at 4 kilobytes aligned offsets generated using SHA256.

6. The system of claim 1 , wherein the operations further include repeatedly generating snapshots of the virtual machine over time.

7. A computer-implemented method at a data management system, the method comprising:
receiving, at a storage appliance from a server hosting a virtual machine, a write made to the virtual machine;
computing, at the storage appliance, a fingerprint of the received write;
comparing, at the storage appliance, the computed fingerprint to malware fingerprints in a malware catalog while the virtual machine continues to receive writes;
repeating the computing and comparing for the continued received writes;
maintaining a log of the continued received writes; and
reversing the writes to revert the virtual machine per the maintained log if a number of matches from the comparing breaches a predetermined threshold over a predetermined amount of time.

8. The method of claim 7 , further comprising restoring the virtual machine using a snapshot stored in the storage appliance to a state before the predetermined threshold was breached.

9. The method of claim 7 , further comprising blocking writes from a source of the matches.

10. The method of claim 7 , further comprising generating the malware catalog including generating fingerprints of binaries and compressed binaries of known malware.

11. The method of claim 10 , wherein the fingerprints are computed at 4 kilobytes aligned offsets generated using SHA256.

12. The method of claim 7 , further comprising repeatedly generating snapshots of the virtual machine over time.

13. A non-transitory, machine-readable medium storing instructions which, when read by a storage appliance, cause the storage appliance to perform operations comprising, at least:
receiving, at the storage appliance from a server hosting a virtual machine, a write made to the virtual machine;
computing, at the storage appliance, a fingerprint of the received write;
comparing, at the storage appliance, the computed fingerprint to malware fingerprints in a malware catalog while the virtual machine continues to receive writes;
repeating the computing and comparing for the continued received writes; and
disabling the virtual machine if a number of matches from the comparing breaches a predetermined threshold over a predetermined amount of time, the predetermined threshold greater than one.

14. The machine-readable medium of claim 13 , wherein the operations further include restoring the virtual machine using a snapshot stored in the storage appliance to a state before the predetermined threshold was breached.

15. The machine-readable medium of claim 13 , wherein the operations further include blocking writes from a source of the matches.

16. The machine-readable medium of claim 13 , wherein the operations further include generating the malware catalog including generating fingerprints of binaries and compressed binaries of known malware.

17. The machine-readable medium of claim 16 , wherein the fingerprints are computed 4 kilobytes aligned offsets generated using SHA256.

18. The machine-readable medium of claim 13 , wherein the operations further include repeatedly generating snapshots of the virtual machine over time.

Assignees

• Rubrik Inc

Inventors

• Mitra Abhay
• Karthik Vijay
• Jain Vivek Sanjay
• Ganguli Avishek
• Kumar Arohi
• Goyal Kushaagra
• Wong Christopher

Classifications

• G06F21/564 Primary

  by virus signature recognition · CPC title

• G06F11/202

  where processing functionality is redundant (redundant communication control functionality G06F11/2005, redundant storage control functionality G06F11/2089) · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F11/1469

  Backup restoration techniques · CPC title