Threat-aware architecture

• US 10,740,456 B1
• Filed: 04/16/2018
• Issued: 08/11/2020
• Est. Priority Date: 01/16/2014
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: Ismael, Osman Abdoul, Aziz, Ashar
• Primary Examiner(s): Sholeman, Abu S
• Application Number:
  US15/954,449
• Time in Patent Office: 848 Days
• Field of Search: 726 30
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5027 the resource being a machine, e.g. CPUs, Servers, Terminals

Abstract

An architecture deployed to facilitate real-time security analysis, including exploit detection and threat intelligence, of operating system (OS) processes executed by a central processing unit (CPU). The architecture features memory configured to store a process, an OS kernel, a VMM and a virtualization module. The virtualization module is configured to communicate with the VMM and execute, at a privilege level of the CPU, to control access permissions to kernel resources accessible by the process. The VMM is configured to execute at a first privilege level of the virtualization module to expose the kernel resources to the OS kernel. The OS kernel is configured to execute at a second privilege level lower than the first privilege level of the virtualization module. The VMM is further configured to instantiate a virtual machine containing the OS kernel, where access to the kernel resources is controlled by the VMM and the virtual machine.

Claims

1. A system comprising:

a central processing unit (CPU);

a memory configured to store, for execution by the CPU, a process, an operating system kernel, a virtual machine monitor (VMM) and a virtualization module,

wherein the virtualization module is configured to communicate with the VMM, the virtualization module being further configured to execute at a privilege level of the CPU to control access permissions to a plurality of kernel resources accessible by the process,

wherein the VMM is configured to execute at a first privilege level of the virtualization module to expose one or more of the plurality of kernel resources to the operating system kernel, the operating system kernel being configured to execute at a second privilege level lower than the first privilege level of the virtualization module, the VMM being configured to instantiate a virtual machine including the operating system kernel, wherein access to the plurality of kernel resources is controlled by the VMM among the virtual machine.

2. The system of claim 1, wherein the virtualization module is further configured to communicate with the VMM over a privileged interface that comprises a set of hyper calls.

3. The system of claim 1, wherein the VMM is further configured to instantiate a micro-virtual machine restricted to contain the process and access to the plurality of kernel resources is controlled by the VMM along with the virtual machine and the micro-virtual machine.

4. The system of claim 1 wherein the VMM is configured as a pass-through module to perform a one-to-one mapping between the plurality of kernel resources and the operating system kernel.

5. The system of claim 1 wherein the virtualization module comprises one or more protection domains, each protection domain including one or more execution contexts, each execution context linked to a scheduling context and configured to interact with capabilities having contents that specify access control permissions to the plurality of kernel resources by the process.

6. The system of claim 5 wherein the scheduling context includes information defining a priority for execution of the execution context on the CPU and wherein the virtualization module further comprises a global scheduler configured to cooperate with the scheduling context to schedule the execution context for execution on the CPU.

7. The system of claim 6 wherein the defined priority is implemented by one or more queues and wherein the global scheduler examines the one or more queues to dispatch the scheduling context to the CPU for execution of its linked execution context.

8. The system of claim 5 wherein the virtualization module further comprises an exception handler configured to service a trap generated by the CPU in response to a capability violation of an access control permission to a kernel resource.

9. The system of claim 8 wherein the trap comprises one of a page fault and a general protection fault.

10. The system of claim 8 wherein the exception handler is further configured to report the capability violation to the VMM.

11. The system of claim 10 wherein the VMM comprises instrumentation logic that is invoked in response to the capability violation to determine whether the process is suspicious.

12. The system of claim 11 wherein, in response to determining that that process is suspicious, the VMM is configured to instantiate the micro-virtual machine for further analysis of the process.

27. The system of claim 1, wherein the VMM instantiates the virtual machine as a container for the operating system kernel.

28. The system of claim 1, wherein the virtual machine includes instrumentation logic directed to detecting anomalous behavior to determine an exploit in an operating system process.

13. A method comprising:

storing a process, an instance of an operating system kernel, a virtual machine monitor (VMM) and a virtualization module in a memory coupled to a central processing unit (CPU);

executing the virtualization module at a first privilege level of the CPU to control access permissions to a plurality of kernel resources accessible by the process;

executing the VMM at a first level of the virtualization module to expose the plurality of kernel resources to the operating system kernel;

executing the operating system kernel at a second privilege level lower than the first privilege level of the virtualization module;

instantiating a first virtual machine containing the operating system kernel;

instantiating a second virtual machine including the process; and

controlling access to the plurality of kernel resources among the first virtual machine and the second virtual machine.

14. The method of claim 13, wherein the second virtual machine is a micro-virtual machine.

15. The method of claim 14 further comprising:

switching privilege levels in response to an interception point, wherein the interception point includes one of a memory access request, a function call and a system call.

16. The method of claim 15 wherein instantiating the virtual machine further comprises:

instantiating first instrumentation logic of the virtual machine directed to determination of an exploit in the process.

17. The method of claim 16 wherein executing the VMM further comprises:

executing second instrumentation logic of the VMM to analyze the interception point originated by the process to invoke services of the operating system kernel.

18. The method of claim 17 wherein executing the VMM further comprises:

in response to the interception point, assuming control over the operating system kernel at the VMM to enable monitoring of activity of the process.

19. The method of claim 18 wherein executing the VMM further comprises:

enabling communication between the operating system kernel and virtualization module over a privileged interface embodied as a set of hyper-calls.

20. A non-transitory computer readable media containing instructions that, when executed by a central processing unit (CPU), perform operations comprising:

storing a process, an instance of an operating system kernel, a virtual machine monitor (VMM) and a virtualization module in a memory coupled to the CPU, wherein the virtualization module being executed at a first privilege level of the CPU to control access permissions to a plurality of kernel resources accessible by the process, the VMM being executed at a first level of the virtualization module to expose the plurality of kernel resources to the operating system kernel, and the operating system kernel being executed at a second privilege level lower than the first privilege level of the virtualization module;

instantiating a first virtual machine containing the operating system kernel;

instantiating a second virtual machine including the process; and

controlling access to the plurality of kernel resources among the first virtual machine and the second virtual machine.

21. The non-transitory computer readable media of claim 20, wherein, upon execution of the VMM by the CPU, the VMM is further configured to instantiate a micro-virtual machine restricted to containing the process and access to the plurality of kernel resources is controlled by the VMM along with the virtual machine and the micro-virtual machine.

22. The non-transitory computer readable media of claim 20, wherein the virtualization module comprises one or more protection domains, each protection domain including one or more execution contexts, each execution context tightly linked to a scheduling context and configured to interact with capabilities having contents that specify access control permissions to the kernel resources by the process.

23. The non-transitory computer readable media of claim 22, wherein the scheduling context includes information defining a priority for execution of the execution context on the CPU and wherein the virtualization module further comprises a global scheduler configured to cooperate with the scheduling context to schedule the execution context for execution on the CPU.

24. The non-transitory computer readable media of claim 22, wherein the virtualization module further comprises an exception handler configured to service a trap generated by the CPU in response to a capability violation of an access control permission to a kernel resource.

25. The non-transitory computer readable media of claim 24, wherein the trap comprises one of a page fault and a general protection fault.

26. The non-transitory computer readable media of claim 24 wherein the exception handler is further configured to report the capability violation to the VMM.