Micro-virtual machine forensics and detection

• US 9,092,625 B1
• Filed: 12/07/2012
• Issued: 07/28/2015
• Est. Priority Date: 07/03/2012
• Status: Active Grant

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Bromium (HP Inc.)
• Inventors: Navaraj, J. McEnroe Samuel, Kashyap, Rahul C, Singh, Baibhav, Passi, Arun, Wojtczuk, Rafal
• Primary Examiner(s): Lewis, Lisa
• Assistant Examiner(s): Lwin, Maung
• Application Number:
  US13/708,703
• Time in Patent Office: 963 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

The execution of a process within a VM may be monitored, and when a trigger event occurs, additional monitoring is initiated, including storing behavior data describing the real-time events taking place inside the VM. This behavior data may then be compared to information about the expected behavior of that type of process in order to determine whether malware has compromised the VM. The trigger event may be analyzed in relation to a set of heuristics, and based on the analysis, a data collection process may be initiated wherein the data comprises information about events occurring in the first virtual machine.

Claims

1. One or more non-transitory computer-readable storage mediums storing one or more sequences of instructions for monitoring task behavior in a virtual machine, which when executed by one or more processors, causes:

executing a plurality of tasks in a plurality of virtual machines executing in a computing environment, wherein each task executes in a separate virtual machine instantiated for the particular task;

identifying an action performed by a first task of the plurality of tasks, wherein the first task is executing in a first virtual machine;

analyzing the action in relation to a set of heuristics;

based on the analysis, initiating a data collection process, wherein the data comprises information about events occurring in the first virtual machine,

wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause;

identifying a suspected file;

determining all files modified after the introduction of the suspected file;

determining what portion of the modified files comprise files of a first file type; and

if the portion of the modified files exceeds a predetermined threshold, then classifying the suspected file as malware.

2. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

identifying all files modified by the first task;

identifying all files initiated as new tasks in the first virtual machine; and

identifying a common set of files modified by the first task and files initiated as new tasks in the first virtual machine.

3. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting an attempt to inject code into a currently-executing process inside the virtual machine.

4. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting an attempt to invoke an executable by a file that has been modified.

5. The one or more non-transitory computer-readable storage mediums of claim 4, wherein the file has been modified within a specified amount of time.

6. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting an attempt to load a modified DLL or system file.

7. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting an attempt by an executing process to modify a master boot record (MBR) or volume boot record (VBR).

8. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting an attempt by a file to delete itself after performing an action.

9. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting an attempt to transfer data via a network; and

identifying whether the attempt matches at least one of a set of prohibited actions.

10. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting an attempt to access or change the kernel memory of a guest operating system executing in a virtual machine, wherein the kernel memory is immutable.

11. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting an attempt to access Windows tokens.

12. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting an attempt by malware to enumerate executing processes inside a virtual machine.

13. The one or more non-transitory computer-readable storage mediums of claim 12, wherein the executing processes comprise drivers.

14. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting an attempt by an executing task to access a physical drive to which the executing task has write permissions.

15. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting an attempt to load a driver inside a virtual machine.

16. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting an attempt to clear system logs.

17. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting an attempt to change an operating system flag identifying pages as read-only to make the pages writable.

18. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting whether a process has accessed registers being utilized by a virtualized system.

19. The one or more non-transitory computer-readable storage mediums of claim 1, wherein determining what portion of the modified files comprise files of a first file type

includes

determining what percentage of the modified files comprise files of said first file type.

20. The one or more non-transitory computer-readable storage mediums of claim 19, wherein the first file type is an executable.

21. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

detecting an attempt to modify a system service.

22. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

identifying all files created after the action; and

creating a hash value for each file.

23. The one or more non-transitory computer-readable storage mediums of claim 22, wherein the hash value comprises a unique identifier, and wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause:

comparing a hash value for a first file to a plurality of hash values in a database; and

matching the first file to a file represented by one of the hash values in the database.

24. An apparatus, comprising:

one or more hardware processors; and

one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed by the one or more hardware processors, cause;

executing a plurality of tasks in a plurality of virtual machines executing in a computing environment, wherein each task executes in a separate virtual machine instantiated for the particular task;

identifying an action performed by a first task of the plurality of tasks, wherein the first task is executing in a first virtual machine;

analyzing the action in relation to a set of heuristics;

based on the analysis, initiating a data collection process, wherein the data comprises information about events occurring in the first virtual machine,

wherein the set of heuristics comprises execution of the one or more sequences of instructions to further cause;

identifying a suspected file;

determining all files modified after the introduction of the suspected file;

determining what portion of the modified files comprise files of a first file type; and

if the portion of the modified files exceeds a predetermined threshold, then classifying the suspected file as malware.