OPTIMIZED RESOURCE ALLOCATION FOR VIRTUAL MACHINES WITHIN A MALWARE CONTENT DETECTION SYSTEM

• US 20140337836A1
• Filed: 05/10/2013
• Published: 11/13/2014
• Est. Priority Date: 05/10/2013
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: Ismael, Osman Abdoul
• Granted Patent: US 9,495,180 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 2009/45579 I/O management, e.g. providing access to device drivers or storage
• CPC Class Codes: G06F 2009/45583 Memory management, e.g. access or allocation
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 3/0604 Improving or facilitating administration, e.g. storage management
• CPC Class Codes: G06F 3/0631 by allocating resources to storage systems
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5011 the resources being hardware resources other than CPUs, Servers and Terminals
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

According to one embodiment, a computerized method comprises operations of instantiating a first virtual machine instance and a second virtual machine instance to run concurrently with the first virtual machine instance. The first virtual machine instance provides a first virtual operating environment while the second virtual machine instance is adapted to share the resources allocated to the first virtual machine instance. The second virtual machine instance is further adapted to allocate additional resources upon conducting a Copy-On Write operation.

Claims

1. A computerized method comprising:

determining software profile information associated with incoming content;

determining, by virtual machine provisioning logic, whether a first virtual machine instance operating with a first software profile that corresponds to the software profile information is currently running, the first virtual machine instance being allocated resources to provide a first virtual execution environment at a prescribed virtual operating state;

instantiating a second virtual machine instance operating with the first software profile to conduct malware analysis on the incoming content, the second virtual machine instance being provided access to the resources allocated for use by the first virtual machine instance.

2. The computerized method of claim 1, wherein the second virtual machine instance being allocated additional resources exclusively accessible by the second virtual machine instance in response to conducting a Copy-On Write operation.

3. The computerized method of claim 2, wherein the second virtual machine instance operating concurrently with the first virtual machine instance.

4. The computerized method of claim 2, wherein the first software profile comprises a type of operating system corresponding to an operating system identified in the software profile information.

5. The computerized method of claim 4, wherein the first software profile further comprises one or more applications being executed by the first virtual machine instance that are identified in the software profile information.

6. The computerized method of claim 2 further comprising:

instantiating a third virtual machine instance that is based on a second software profile different than the first software profile, the third virtual machine instance being allocated resources that are not shared by the first virtual machine instance and the second virtual machine instance.

7. The computerized method of claim 1, further comprising:

after instantiation of a plurality of virtual machine instances including the first virtual machine instance and the second virtual machine instances, determining whether instantiation of a third virtual machine instance would exceed a threshold, the threshold representing a predetermined number of concurrently operating virtual machine instances; and

instantiating the third virtual machine instance if a sum of the plurality of virtual machine instances does not exceed the threshold; and

refraining from instantiating the third virtual machine instance if the sum of the plurality of virtual machine instances exceeds the threshold.

8. The computerized method of claim 7, wherein the threshold is equal to a first value when a first prescribed number of the plurality of virtual machine instances are virtual machine clones being virtual machine instances operating in an initial operating state upon creation.

9. The computerized method of claim 8, wherein the threshold is equal to a second value that is less than the first value when a second prescribed number of the plurality of virtual machine instances are virtual machine clones, the second prescribed number being less than the first prescribed number.

10. The computerized method of claim 8, wherein the resources include one or more memory pages within a system memory implemented within an electronic device.

11. The computerized method of claim 8, wherein the first software profile identifying the same version of an operating system and a different version of a particular application as the second software profile.

12. The computerized method of claim 8, wherein the first software profile identifies a first type of operating system and a first version of the first type of the operating system while the second software profile identifies the first type of operating system and a second version of the first type of the operating system, wherein the first version is different from the second version.

13. A computerized method comprising:

determining software profile information associated with incoming content;

instantiating a first set of virtual machine instances to conduct malware analysis on the incoming content, each virtual machine instance of the first set of virtual machine instances being placed into a first virtual operating state with shared access to a first resource; and

instantiating a second set of virtual machine instances to conduct malware analysis on the incoming content, each virtual machine instance of the second set of virtual machine instances being placed into a second virtual operating state with access to a second resource different than the first resource.

14. The computerized method of claim 13, wherein the first set of virtual machine instances comprises two or more virtual machine instances each based on a first software profile.

15. The computerized method of claim 14, wherein the first software profile comprises a particular type of operating system.

16. The computerized method of claim 15, wherein the second set of virtual machine instances comprises one or more virtual machine instances based on a second software profile.

17. The computerized method of claim 15, wherein a first virtual machine instance of the first set of virtual machine instances being allocated access to a third resource different than the first resource upon conducting a Copy-On Write operation.

18. The computerized method of claim 17, wherein the third resource comprises one or more areas of data storage different than the first resource and the second resource.

19. An electronic device, comprising:

a network port adapted to receive incoming content; and

a controller coupled to the network port, the controller to (i) determine software profile information associated with the incoming content, (ii) determine whether a first virtual machine instance operating with a first software profile that corresponds to the software profile information is currently running, the first virtual machine instance being allocated resources to provide a first virtual execution environment at a prescribed virtual operating state, and (iii) instantiate a second virtual machine instance operating with the first software profile to conduct malware analysis on the incoming content, the second virtual machine instance being provided access to the resources allocated for use by the first virtual machine instance.

20. The electronic device of claim 19, wherein the controller is configured to allocate additional resources exclusively accessible by the second virtual machine instance in response to the second virtual machine instance conducting a Copy-On Write operation.

21. The electronic device of claim 20, wherein the second virtual machine instance operating concurrently with the first virtual machine instance.

22. The electronic device of claim 20, wherein the first software profile comprises a type of operating system corresponding to an operating system identified in the software profile information and one or more applications being executed by the second virtual machine instance that are identified in the software profile information.

23. The electronic device of claim 20, wherein the controller is further configured to instantiate a third virtual machine instance that is based on a second software profile different than the first software profile, the third virtual machine instance being allocated resources that are not shared by the first virtual machine instance and the second virtual machine instance.

24. The electronic device of claim 19, wherein the controller is further configured, after instantiation of a plurality of virtual machine instances including the first virtual machine instance and the second virtual machine instances, to (i) determine whether instantiation of a third virtual machine instance would exceed a threshold, the threshold representing a predetermined number of concurrently operating virtual machine instances, and (ii) instantiating the third virtual machine instance if a sum of the plurality of virtual machine instances does not exceed the threshold or refraining from instantiating the third virtual machine instance if the sum of the plurality of virtual machine instances exceeds the threshold.

25. The electronic device of claim 24, wherein the threshold is equal to a first value when a first prescribed number of the plurality of virtual machine instances are virtual machine clones being virtual machine instances operating in an initial operating state upon creation.

26. The electronic device of claim 25, wherein the threshold is equal to a second value that is less than the first value when a second prescribed number of the plurality of virtual machine instances are virtual machine clones, the second prescribed number being less than the first prescribed number.

27. A malware content detection system, comprising:

a network port adapted to receive incoming content; and

a controller coupled to the network port, the controller to (i) determine software profile information associated with the incoming content, (ii) instantiate a first virtual machine instance that is based on a first software profile corresponding to the software profile information to conduct malware analysis on incoming content, the first virtual machine instance being placed into an initial virtual operating state with access to a first resource allocated to be shared with other virtual machine instances that are based on the first software profile, and (iii) allocate access to a second resource different from the first resource through a Copy-On-Write operation if a portion of the first resource is to be written to during execution of the first virtual machine instance.