Monitoring a target agent execution pattern on a VT-enabled system

• US 20080082722A1
• Filed: 09/29/2006
• Published: 04/03/2008
• Est. Priority Date: 09/29/2006
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Savagaonkar, Uday, Sahita, Ravi, Durham, David
• Granted Patent: US 7,802,050 B2
• Time in Patent Office: Days
• US Class Current: 711/6
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

Methods, apparatuses, articles, and systems for observing, by a virtual machine manager of a physical device, execution of a target process of a virtual machine of the physical device, including virtual addresses of the virtual machine referenced during the execution, are described herein. The virtual machine manager further determines whether the target process is executing in an expected manner based at least in part on the observed virtual address references and expected virtual address references.

Claims

1. A method comprising:

observing, by a virtual machine manager of a physical device, execution of a target process of a virtual machine of the physical device, including virtual addresses of the virtual machine referenced during the execution; and

determining, by the virtual machine manager, whether the target process is executing in an expected manner based at least in part on the observed virtual address references and expected virtual address references.

2. The method of claim 1, wherein the expected execution manner is reflected in an integrity manifest, the manifest including virtual addresses the target process is expected to reference, and the determining comprises comparing by the virtual machine manager the observed virtual address references with the expected virtual address references.

3. The method of claim 2, wherein the observing is performed by a memory manager of the virtual machine manager, and the method further comprises modifying by the memory manager active page tables of the virtual machine manager, so that said references to virtual addresses are trapped for processing by the memory manager.

4. The method of claim 3, wherein said modifying, by the memory manager, comprises modifying the active page tables of the virtual machine manager so that said references to virtual addresses cause page faults to the memory manager.

5. The method of claim 2, wherein the observing is performed by a memory manager of the virtual machine manager, and the method further comprises modifying by the memory manager nested and extended page tables of the virtual machine manager, so that said references to virtual addresses are trapped for processing by the memory manager.

6. The method of claim 2, wherein the observing is performed by a code instrumentation engine of the virtual memory manager, and the method further comprises modifying the target process, by the code instrumentation engine, so that said references to the virtual addresses are trapped for processing by the code instrumentation engine.

7. The method of claim 6, wherein the modification comprises modifying the target process to call the code instrumentation engine when the virtual addresses are to be referenced, and the method further comprises

first, on trapping of a reference, restoring, by the code instrumentation engine, replaced instructions of the target process to enable an original function to be executed,

second, on trapping of a reference, notifying, by the code instrumentation engine, a verification engine of the trapping, the verification engine noting the reference to the virtual address, and

third, on execution, re-modifying, by the code instrumentation engine, the instruction to enable future reference to the virtual address to be trapped to the code instrumentation engine again.

8. The method of claim 1, wherein the virtual addresses are memory mapped to a computing device register.

9. The method of claim 1, further comprising additionally observing a type of memory access for at least one of the observed virtual address references.

10. The method of claim 1, further comprising a verification engine comparing reference statistics of various virtual addresses to corresponding threshold metrics.

11. The method of claim 1, wherein the target process is an intrusion detection process.

12. The method of claim 1, wherein said observing further comprises monitoring at least one of interdependencies and call and return points of the target process and another process virtually referenced by the target process.

13. A physical device comprising:

one or more processors; and

a virtual machine manager operated by the one or more processors and adapted to observe execution of a target process of a virtual machine of the physical device, including observation of virtual addresses of the virtual machine referenced during the execution, and to determine whether the target process is executing in an expected manner based at least in part on the observed virtual address references and expected virtual address references, the virtual machine manager including a memory manager adapted to perform said observing, including modification of active page tables so that references to virtual addresses are trapped for processing by the memory manager.

14. The physical device of claim 13, wherein the virtual machine and the virtual machine manager are operated by the same processor.

15. The physical device of claim 13, wherein said memory manager is adapted to modify the active page tables of the virtual machine manger so that said references to virtual addresses cause page faults to the memory manager.

16. The physical device of claim 15, wherein the expected execution manner is reflected in an integrity manifest, the manifest including virtual addresses the target process is expected to reference, and the virtual machine manager further comprises a verification engine adapted to perform said determining by comparing the observed virtual address references with the expected virtual address references and to generate reference statistics based on the comparison.

17. The physical device of claim 16, wherein the virtual machine manager further includes an integrity management module adapted to verify the integrity of the target process using the integrity manifest, wherein the integrity manifest further describes the target process as it is loaded in memory of the physical device.

18. The physical device of claim 16, wherein the verification engine is further adapted to compare the reference statistics of various virtual addresses to corresponding threshold metrics.

19. The physical device of claim 13, wherein the target process is an intrusion detection process.

20. An article of manufacture comprising:

a storage medium; and

a plurality of programming instructions designed to program a physical device to provide a virtual machine manager including a code instrumentation engine to the physical device, to enable the physical device to

modify, using the code instrumentation engine, a target process of a virtual machine of the physical device, so that said references to virtual addresses of the virtual machine are trapped for processing by the code instrumentation engine,

observe, using the code instrumentation engine of the virtual machine manager of the physical device, execution of the target process, including virtual addresses of the virtual machine referenced during the execution, and

determine, by the virtual machine manager, whether the target process is executing in an expected manner based at least in part on the observed virtual address references and expected virtual address references.

21. The article of claim 20, wherein the expected execution manner is reflected in an integrity manifest, the manifest including virtual addresses the target process is expected to reference, and the programming instructions further enable the physical device to perform the determining by the virtual machine manager comparing the observed virtual address references with the expected virtual address references.

22. The article of claim 21, wherein the plurality of programming instructions are further designed to provide the virtual machine manager with a verification engine, enabling the physical device to further perform the determining by the verification engine comparing reference statistics of various virtual addresses to corresponding threshold metrics.

23. The article of claim 20, wherein the plurality of programming instructions are further designed to program the physical device to enable the physical device to modify the target process, using the code instrumentation engine, so the target process calls the code instrumentation engine when the virtual addresses are to be referenced, and

the plurality of programming instructions are further designed to program the physical device to enable the physical device to restore the target process on trapping of a reference, using the code instrumentation engine, replacing instructions of the target process to enable an original function to be executed, and to re-modify the process on execution, to enable future reference to the virtual address to be trapped to the code instrumentation engine again.

24. The article of claim 23, wherein the programming instructions are further adapted to provide the virtual machine manager with a verification engine, and to provide the code instrumentation engine adapted to notify the verification engine, on trapping of a reference, with the verification engine noting the reference to the virtual address.

25. The article of claim 20, wherein the target process is an intrusion detection process.

26. A system comprising:

one or more processors;

volatile memory coupled to the one or more processors, and capable of storing observed virtual addresses referenced during execution of a target process of a virtual machine of the system and expected virtual address references for comparison; and

a mass storage coupled to the one or more processors, and having stored therein instructions implementing a virtual machine manager operated by one of the one or more processors and adapted to

observe, by the virtual machine manager, the execution of the target process, including the virtual addresses referenced during the execution; and

determine whether the target process is executing in an expected manner based at least in part on the observed virtual address references and expected virtual address references.

27. The system of claim 26, wherein the virtual machine manager further comprises a memory manager adapted to perform said observing and to modify active page tables of the virtual machine manger so that said references to virtual addresses cause page faults to the memory manager.

28. The system of claim 26, wherein the expected execution manner is reflected in an integrity manifest, the manifest including virtual addresses the target process is expected to reference and the virtual machine manager further comprises a verification engine adapted to compare the observed virtual address references with the expected virtual address references and to generate the reference statistics based on the comparison.

29. The system of claim 28, wherein the virtual machine manager further comprises an integrity management module, the integrity measurement module adapted to verify the integrity of the target process using the integrity manifest, wherein the integrity manifest further describes the target process as it is loaded in the mass storage.

30. The system of claim 26, wherein the target process is an intrusion detection process.