Mitigation of virtual machine security breaches

Patent metadata

Field	Value
Publication number	US-9600320-B2
Application number	US-201514619140-A
Country	US
Kind code	B2
Filing date	Feb 11, 2015
Priority date	Feb 11, 2015
Publication date	Mar 21, 2017
Grant date	Mar 21, 2017

Abstract

An approach provides solutions for responding to threats to virtual machines (VMs) and mitigating the risks of potential breaches to VMs that reside in the same neighborhood as VMs that are affected by threats. The approach can provide proactive responsive actions for one or more VMs in a determined neighborhood that help protect those VMs in a selective and prioritized manner.

First claim

What is claimed is:

1. A method for responding to a threat affecting a virtual machine, comprising:
detecting, by one or more computer processors, a threat affecting a first virtual machine;
responsive to detecting the threat affecting the first virtual machine, determining, by one or more computer processors, a neighborhood of the first virtual machine comprising one or more virtual machines that might be affected by the detected threat;
calculating, by one or more computer processors, a response factor for each virtual machine in the determined neighborhood;
determining, by one or more computer processors, a first responsive action to perform to protect a second virtual machine in the determined neighborhood from the detected threat based at least on the calculated response factor for the second virtual machine;
determining, by one or more computer processors, a second responsive action to perform to protect a third virtual machine in the determined neighborhood from the detected threat based at least on the calculated response factor for the third virtual machine;
determining, by one or more computer processors, an order in which to perform the first responsive action and second responsive action based upon at least the calculated response factors for the second virtual machine and the third virtual machine; and
performing, by one or more computer processors, the first responsive action and the second responsive action in the determined order.

2. The method of claim 1 , wherein the neighborhood is determined based upon at least logical distances between the first virtual machine and the one or more virtual machines that might be affected by the detected threat.

3. The method of claim 2 , wherein a logical distance between the first virtual machine and the second virtual machine is calculated based upon at least an extent to which the first virtual machine and the second virtual machine share resources, users, domains, networks, storage, applications, hypervisors, and virtual adapters.

4. The method of claim 1 , wherein the first responsive action comprises migrating the second virtual machine to another host computer system, and the second responsive action comprises migrating a workload of the third virtual machine to another virtual machine on a same host computer system as the third virtual machine.

5. The method of claim 4 , wherein the first responsive action is determined based on the calculated response factor for the second virtual machine satisfying a specified threshold that is not satisfied by the calculated response factor for the third virtual machine.

6. The method of claim 1 , wherein the calculated response factor for each particular virtual machine reflects an urgency with which action should be taken to protect that particular virtual machine from the detected threat.

7. The method of claim 1 , wherein the response factor for each particular virtual machine is calculated based upon at least a logical distance between that particular virtual machine and the first virtual machine, and one or more numerical values that reflect a degree of risk of the detected threat spreading from the first virtual machine to that particular virtual machine.

8. The method of claim 1 , wherein calculating, by one or more computer processors, a response factor for each virtual machine in the determined neighborhood comprises:
calculating, by one or more computer processors, an urgency factor for the first virtual machine based upon at least a value reflecting a level of confidence in one or more security alerts associated with the detected threat, a value reflecting strength of the first virtual machine, a value reflecting an ability of security controls to protect the first virtual machine, a value reflecting risk that multi-tenant security controls cannot isolate the first virtual machine, and a value reflecting elapsed time since the detected threat was detected or since the detected threat occurred; and
calculating, by one or more computer processors, for each particular virtual machine in the determined neighborhood, the response factor for that particular virtual machine based upon at least a logical distance between that particular virtual machine and the first virtual machine and the urgency factor for the first virtual machine.

9. A computer program product for responding to a threat affecting a virtual machine, comprising:
one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising:
program instructions to detect a threat affecting a first virtual machine;
program instructions to, responsive to detecting the threat affecting the first virtual machine, determine a neighborhood of the first virtual machine comprising one or more virtual machines that might be affected by the detected threat;
program instructions to calculate a response factor for each virtual machine in the determined neighborhood;
program instructions to determine a first responsive action to perform to protect a second virtual machine in the determined neighborhood from the detected threat based at least on the calculated response factor for the second virtual machine;
program instructions to determine a second responsive action to perform to protect a third virtual machine in the determined neighborhood from the detected threat based at least on the calculated response factor for the third virtual machine;
program instructions to determine an order in which to perform the first responsive action and second responsive action based upon at least the calculated response factors for the second virtual machine and the third virtual machine; and
program instructions to perform the first responsive action and the second responsive action in the determined order.

10. The computer program product of claim 9 , wherein the neighborhood is determined based upon at least logical distances between the first virtual machine and the one or more virtual machines that might be affected by the detected threat.

11. The computer program product of claim 10 , wherein a logical distance between the first virtual machine and the second virtual machine is calculated based upon at least an extent to which the first virtual machine and the second virtual machine share resources, users, domains, networks, storage, applications, hypervisors, and virtual adapters.

12. The computer program product of claim 9 , wherein the first responsive action comprises migrating the second virtual machine to another host computer system, and the second responsive action comprises migrating a workload of the third virtual machine to another virtual machine on a same host computer system as the third virtual machine.

13. The computer program product of claim 12 , wherein the first responsive action is determined based on the calculated response factor for the second virtual machine satisfying a specified threshold that is not satisfied by the calculated response factor for the third virtual machine.

14. The computer program product of claim 9 , wherein the calculated response factor for each particular virtual machine reflects an urgency with which action should be taken to protect that particular virtual machine from the detected threat.

15. The computer program product of claim 9 , wherein the response factor for each particular virtual machine is calculated based upon at least a logical distance between that particular virtual machine and the first virtual machine, and one or more numerical values that reflect a degree of risk of the detected threat spreading from the first

Assignees

• IBM

Inventors

• Hamilton Ii Rick A
• Hoy Jeffrey R
• Li Jenny S
• Mullen Shawn P

Classifications

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title