Method and system for malware detection in virtual machines

Patent metadata

Field	Value
Publication number	US-9733969-B2
Application number	US-201514755517-A
Country	US
Kind code	B2
Filing date	Jun 30, 2015
Priority date	Jun 30, 2015
Publication date	Aug 15, 2017
Grant date	Aug 15, 2017

Abstract

Example embodiments relate to methods, systems, and a computer program product for detecting and responding to the presence of malware persistently executing in a monitored virtual machine of a virtual computing platform. The method includes logging I/O requests at a hypervisor kernel in a kernel log and at a virtual machine (VM) managed by the hypervisor in a VM log. The logged I/O requests then may be compared to detect evidence of malware according to differences between the I/O requests logged in the VM log and the kernel log.

First claim

What is claimed is:

1. A method comprising:
logging input/output (I/O) requests at a virtual machine (VM) in a VM log;
logging I/O requests at a hypervisor kernel managing the VM in a kernel log, wherein the logging both I/O requests comprises generating signatures from both the VM log metadata and the kernel log metadata, further wherein the logging both I/O requests comprises logging one or more of a timestamp, an I/O type, a start address, an offset, and a length I/O metadata;
comparing the I/O requests logged in the VM log and the kernel log, when comparing the I/O requests logged in the VM log and the kernel log comprises comparing the signatures; and
detecting evidence of malware according to differences between the I/O requests logged in the VM log and the kernel log.

2. The method of claim 1 wherein comparing the I/O requests logged in the VM log and the kernel log comprises examining differences in one or more of the timestamps, the I/O types, the write start addresses, the write offsets, and the write lengths for respective I/Os as recorded in the VM log and the kernel log.

3. The method of claim 1 wherein logging I/O requests at a VM in a VM log comprises logging I/O requests to a master boot record for the VM.

4. The method of claim 1 wherein logging I/O requests at a VM in a VM log comprises logging I/O requests to an operating system for the VM.

5. The method of claim 1 wherein logging I/O requests at a hypervisor kernel managing the VM in a kernel log comprises logging VM boot-time disk access I/Os.

6. The method of claim 1 wherein logging I/O requests at a hypervisor kernel managing the VM in a kernel log is undetectable by malware operating in the VM.

7. The method of claim 1 further comprising:
injecting an I/O to perform specific I/O accesses; and
comparing the VM log and the kernel log to probe for potential malware.

8. The method of claim 1 further comprising providing a notification of the evidence of malware.

9. A system comprising:
a processor;
a memory coupled to the processor, wherein the memory has program logic comprising:
a virtual machine computing platform having a hypervisor and managing a virtual machine (VM);
a VM risk agent configured to log input/output (I/O) requests at the VM in a VM log; and
a kernel risk agent configured to log the I/O requests at the hypervisor kernel in a kernel log, wherein the kernel risk agent and the VM risk agent are further configured to generate signatures from both the VM log metadata and the kernel log metadata, wherein the kernel risk agent and the VM risk agent are further configured to log one or more of a timestamp, an I/O type, a start address, an offset, and a length I/O metadata;
a risk engine configured to compare the I/O requests logged in the VM log and the kernel log and detect evidence of malware according to differences between the I/O requests logged in the VM log and the kernel log, wherein the risk engine is further configured to compare the signatures.

10. The system of claim 9 wherein the risk engine is further configured to examine differences in one or more of the timestamps, the I/O types, the write start addresses, the write offsets, and the write lengths for respective I/Os as recorded in the VM log and the kernel log.

11. The system of claim 9 wherein the VM risk agent is further configured to log I/O requests to a master boot record for the VM.

12. The system of claim 9 wherein the VM risk agent is further configured to log I/O requests to an operating system for the VM.

13. The system of claim 9 wherein the kernel risk agent is further configured to log VM boot-time disk access I/Os.

14. The system of claim 9 wherein the kernel risk agent is undetectable by malware operating in the VM.

15. The system of claim 9
wherein the VM risk agent is further configured to inject an I/O to perform specific I/O accesses; and
wherein the risk engine is further configured to compare the VM log and the kernel log to probe for potential malware.

16. The system of claim 9 wherein the risk engine is further configured to provide a notification of the evidence of malware.

17. A computer program product including a non-transitory computer readable storage medium having computer program code encoded thereon that, when executed by a processor of a computer causes the computer to detect evidence of malware, comprising:
computer program code for logging input/output (I/O) requests at a virtual machine (VM) in a VM log;
computer program code for logging I/O requests at a hypervisor kernel managing the VM in a kernel log, wherein the logging both I/O requests comprises generating signatures from both the VM log metadata and the kernel log metadata, further wherein the logging both I/O requests comprises logging one or more of a timestamp, an I/O type, a start address, an offset, and a length I/O metadata;
computer program code for comparing I/O requests logged in a virtual machine (VM) log by a VM risk agent and a kernel log by a hypervisor kernel, wherein comparing the I/O requests logged in the VM log and the kernel log comprises comparing the signatures; and
computer program code for detecting evidence of malware according to differences between the I/O requests logged in the VM log and the kernel log.

18. The computer program product of claim 17 wherein comparing the I/O requests logged in the VM log and the kernel log comprises examining differences in one or more of the timestamps, the I/O types, the write start addresses, the write offsets, and the write lengths for respective I/Os as recorded in the VM log and the kernel log.

19. The computer program product of claim 17 further comprising:
injecting an I/O to perform specific I/O accesses; and
comparing the VM log and the kernel log to probe for potential malware.

Assignees

• Emc Corp
• Emc Ip Holding Co Llc

Inventors

• Derbeko Philip
• Natanzon Assaf
• Bakshi Maya

Classifications

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F2009/45579

  I/O management, e.g. providing access to device drivers or storage · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title