Virtualization detection

• US 9,250,940 B2
• Filed: 12/21/2012
• Issued: 02/02/2016
• Est. Priority Date: 12/21/2012
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Mickens, James W.
• Primary Examiner(s): DAO, TUAN C.
• Application Number:
  US13/725,882
• Publication Number:
  US 20140181819A1
• Time in Patent Office: 1,138 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 9/45529 Embedded in an application, e.g. JavaScript in a Web browser

Abstract

A baseline set of graph information associated with a predefined execution environment of a program may be obtained, the baseline set associated with a baseline time interval. The predefined execution environment includes predefined environment objects, at least a portion of which are dynamically mutatable. A second set of graph information associated with the predefined execution environment may be obtained, the second set associated with a second time interval that is later in time than the baseline time interval. The baseline set and the second set may be compared to detect virtualization activity associated with a dynamic runtime.

Claims

1. A system comprising:

a device that includes at least one processor, and a computer readable storage medium storing instructions for execution by the at least one processor, for implementing a virtualization detection engine that;

obtains a baseline set of graph information associated with a predefined execution environment of a program, the baseline set associated with a baseline time interval, the predefined execution environment including predefined environment objects, at least a portion of the predefined environment objects being dynamically mutatable;

obtains a second set of graph information associated with the predefined execution environment, the second set associated with a second time interval that is later in time than the baseline time interval;

initiates storage of the baseline set of graph information in a private storage location that is privately available to the predefined execution environment; and

detects virtualization activity associated with a dynamic runtime by comparing the baseline set and the second set.

2. The system of claim 1, wherein:

the predefined environment objects that are dynamically mutatable include one or more of;

environment variables,

environment functions,

environment references,

environment constant values, or

environment state values.

3. The system of claim 1, wherein:

the predefined execution environment of the program includes one or more of;

a predefined JAVASCRIPT execution environment of a web browser,

a predefined RUBY execution environment, or

a predefined PYTHON execution environment.

4. The system of claim 1, wherein:

the second set of graph information is obtained via invocation of a first non-virtualizable function, wherein the first non-virtualizable function is defined by the predefined execution environment.

5. The system of claim 4, wherein the virtualization detection engine further:

obtains a first supplemental set of graph information associated with a program graph that is induced based on predefined program objects of the program, and predefined relationships between the predefined program objects, at the baseline time interval,

obtains a second supplemental set of graph information associated with the program graph, at the second time interval,

adds the first supplemental set to the baseline set of graph information via a second non-virtualizable function invoked by the program, the second non-virtualizable function defined by the predefined execution environment, and

adds the second supplemental set to the second set of graph information via the second non-virtualizable function, wherein;

comparing the baseline set and the second set includes comparing the baseline set that includes the first supplemental set and the second set that includes the second supplemental set, to detect the virtualization activity associated with the dynamic runtime.

6. The system of claim 4, wherein the virtualization detection engine further:

obtains a third set of graph information associated with the predefined execution environment, at a third time interval that is later in time than the second time interval, the third set obtained via invocation of the first non-virtualizable function, wherein;

detecting the virtualization activity associated with the dynamic runtime is based on comparing the baseline set and the third set.

7. The system of claim 1, wherein:

the baseline set of graph information includes baseline state information associated with the predefined execution environment objects and relationships between the predefined execution environment objects, at the baseline time interval, wherein a graph associated with the baseline set of graph information is induced based on graph nodes representing the predefined execution environment objects and graph edges representing the relationships between the predefined execution environment objects, and

the second set of graph information includes second state information associated with the predefined execution environment objects and the relationships between the predefined execution environment objects, at the second time interval.

8. The system of claim 1, wherein the virtualization detection engine:

obtains the baseline set of graph information based on recursively first traversing nodes representing predefined execution environment objects that are reachable via references from global variables in the predefined execution environment, at the baseline time interval, and storing values associated with first traversal visited nodes in a first list, and

obtains the second set of graph information based on recursively second traversing the nodes representing the predefined execution environment objects that are reachable via references from global variables in the predefined execution environment, at the second time interval, and storing values associated with second traversal visited nodes in a second list.

9. The system of claim 8, wherein:

the virtualization detection engine compares the baseline set and the second set based on one or more of;

comparing a size of the first list with a size of the second list, or

comparing a value of each element of the first list to a value of a corresponding element of the second list.

10. The system of claim 1,

wherein the baseline set of graph information is available for use by the predefined execution environment, in lieu of at least a portion of the predefined environment objects that are dynamically mutatable.

11. The system of claim 1,

wherein the virtualization detection engine initiates validation of current output of at least one function that is defined by the predefined execution environment, wherein

the baseline set of graph information is obtained via invocation of the at least one function after validation of output, wherein

the second set of graph information is obtained via invocation of the at least one function after validation of output.

12. A method comprising:

obtaining a baseline set of graph information associated with a predefined JAVASCRIPT execution environment of a web browser, the baseline set indicating a baseline state of the predefined JAVASCRIPT execution environment at a baseline time interval;

obtaining a second set of graph information associated with the predefined JAVASCRIPT execution environment, the second set indicating a second state of the predefined JAVASCRIPT execution environment at a second time interval that is later in time than the baseline time interval;

initiating storage of the baseline set of graph information in a private storage location that is privately available to the predefined JAVASCRIPT execution environment; and

detecting virtualization activity associated with a dynamic runtime by comparing the baseline set and the second set.

13. The method of claim 12, wherein:

the second set of graph information is obtained via a first non-virtualizable function invoked by the web browser, the first non-virtualizable function defined by the predefined JAVASCRIPT execution environment.

14. The method of claim 12, further comprising:

initiating a validation of current output of at least one function that is defined by the predefined JAVASCRIPT execution environment, wherein

the baseline set of graph information is obtained via invocation of the at least one function after validation of output, wherein

the second set of graph information is obtained via invocation of the at least one function after validation of output.

15. A computer program product comprising a hardware computer-readable storage medium storing executable code that, when executed, causes at least one data processing apparatus to:

obtain a baseline set of state information associated with predefined execution environment objects that are included in a predefined execution environment of a program, at least a portion of the predefined execution environment objects being dynamically mutatable, the baseline set of state information indicating a baseline state of the predefined execution environment at a baseline time interval;

obtain a second set of state information associated with the predefined execution environment objects, the second set of state information indicating a second state of the predefined execution environment at a second time interval that is later in time than the baseline time interval;

initiate storage of the baseline set of state information in a private storage location that is privately available to the predefined execution environment; and

initiate a comparison of the baseline set of state information and the second set of state information to determine virtualization activity associated with a dynamic runtime.

16. The computer program product of claim 15, wherein the executable code, when executed, causes the at least one data processing apparatus to:

obtain the baseline set of state information based on obtaining a baseline set of graph information associated with the predefined execution environment of the program, wherein a graph associated with the baseline set of graph information is induced based on graph nodes representing the predefined execution environment objects and graph edges representing the relationships between the predefined execution environment objects, and

obtain the second set of state information based on obtaining a second set of graph information associated with the predefined execution environment of the program, wherein a graph associated with the second set of graph information is induced based on the graph nodes representing the predefined execution environment objects and the graph edges representing the relationships between the predefined execution environment objects, at the second time interval.

17. The computer program product of claim 16, wherein:

the baseline set of graph information includes baseline state information associated with the predefined execution environment objects and relationships between the predefined execution environment objects, at the baseline time interval, wherein a graph associated with the baseline set of graph information is induced based on graph nodes representing the predefined execution environment objects and graph edges representing the relationships between the predefined execution environment objects, and

the second set of graph information includes second state information associated with the predefined execution environment objects and the relationships between the predefined execution environment objects, at the second time interval.

18. The computer program product of claim 16, wherein the executable code, when executed, causes the at least one data processing apparatus to:

obtain the second set of state information via invocation of a first non-virtualizable function, wherein the first non-virtualizable function is defined by the predefined execution environment;

obtain the baseline set of graph information based on recursively first traversing nodes representing predefined execution environment objects that are reachable via references from global variables in the predefined execution environment, at the baseline time interval, and storing values associated with first traversal visited nodes in a first list, and

obtain the second set of graph information based on recursively second traversing the nodes representing the predefined execution environment objects that are reachable via references from global variables in the predefined execution environment, at the second time interval, and storing values associated with second traversal visited nodes in a second list.

19. The computer program product of claim 18, wherein the executable code, when executed, causes the at least one data processing apparatus to:

initiate the comparison of the baseline set of state information and the second set of state information based on one or more of;

comparing a size of the first list with a size of the second list, or

comparing a value of each element of the first list to a value of a corresponding element of the second list.

20. The computer program product of claim 15, wherein the executable code, when executed, causes the at least one data processing apparatus to:

initiate a validation of current output of at least one function that is defined by the predefined execution environment, wherein

the baseline set of graph information is obtained via invocation of the at least one function after validation of output, wherein

the second set of graph information is obtained via invocation of the at least one function after validation of output.