Forensic instance snapshotting
First Claim
Patent Images
1. A computer-implemented method, comprising:
- under the control of one or more computer systems that execute instructions,configuring an event trigger for causing, upon occurrence of a predetermined event, a set of local changes made to a virtual machine of a plurality of virtual machines in a distributed computing environment to be captured, each virtual machine of the plurality of virtual machines having virtual memory and access to storage; and
for each virtual machine of the plurality of virtual machines;
running the virtual machine, wherein the virtual machine is instantiated at least in part from a base software image and in isolation from one or more networks;
obtaining a first snapshot of the virtual machine, the first snapshot including states of the virtual memory and the storage at a first time;
determining a set of differences between the first snapshot and a base snapshot;
connecting the virtual machine to the one or more networks; and
as a result of the occurrence of the predetermined event triggering the event trigger;
obtaining a second snapshot of the virtual machine, the second snapshot including states of the virtual memory and the storage at a second time;
deriving a derived first snapshot based at least in part on the base snapshot and the set of differences;
determining the set of local changes based at least in part on differences between the second snapshot and the derived first snapshot; and
storing the set of local changes in persistent storage; and
terminating the virtual machine.
1 Assignment
0 Petitions
Accused Products
Abstract
A system and method for capturing forensic snapshots of virtual machines prior to terminating the virtual machine, the system and method including obtaining a configuration that specifies an event and running a virtual machine in accordance with the configuration. Upon detection of an occurrence of the specified event, the system and method further includes determining a state of the virtual machine, storing information based at least in part on the determined state of the virtual machine, the information usable at least in part to recreate the state of the virtual machine, terminating the virtual machine, and running another virtual machine in accordance with the configuration.
-
Citations
23 Claims
-
1. A computer-implemented method, comprising:
under the control of one or more computer systems that execute instructions, configuring an event trigger for causing, upon occurrence of a predetermined event, a set of local changes made to a virtual machine of a plurality of virtual machines in a distributed computing environment to be captured, each virtual machine of the plurality of virtual machines having virtual memory and access to storage; and for each virtual machine of the plurality of virtual machines; running the virtual machine, wherein the virtual machine is instantiated at least in part from a base software image and in isolation from one or more networks; obtaining a first snapshot of the virtual machine, the first snapshot including states of the virtual memory and the storage at a first time; determining a set of differences between the first snapshot and a base snapshot; connecting the virtual machine to the one or more networks; and as a result of the occurrence of the predetermined event triggering the event trigger; obtaining a second snapshot of the virtual machine, the second snapshot including states of the virtual memory and the storage at a second time; deriving a derived first snapshot based at least in part on the base snapshot and the set of differences; determining the set of local changes based at least in part on differences between the second snapshot and the derived first snapshot; and storing the set of local changes in persistent storage; and terminating the virtual machine. - View Dependent Claims (2, 3, 4)
-
5. A system, comprising:
-
one or more processors; and memory including instructions that, as a result of execution by the one or more processors, cause the system to; launch one or more virtual machines that are associated with a configuration specifying that an occurrence of a predetermined event is to cause a virtual machine of the one or more virtual machines to stop running; for each of the one or more virtual machines; instantiate the virtual machine in isolation from a network; obtain an initial state of the virtual machine; determine a set of differences between the initial state and a baseline state; connect the virtual machine to the network; and determine whether the predetermined event has occurred; and upon determining that the predetermined event has occurred, for the virtual machine; obtain a current state of the virtual machine; derive, based at least in part on the baseline state and the set of differences, a derived initial state; without storing the current state, store a set of local changes between the current state and the derived initial state of the virtual machine into persistent storage; de-provision the virtual machine; and launch a new virtual machine having a configuration specifying that the new virtual machine is to stop running after another occurrence of the predetermined event. - View Dependent Claims (6, 7, 8, 9, 10, 11, 12)
-
-
13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of execution by one or more processors of a computer system of a computing resource service provider, cause the computer system to at least:
-
obtain a configuration that specifies a set of events; run a virtual machine under a virtualization layer of the computer system in accordance with the configuration, the virtual machine instantiated in isolation from a network; obtain an initial state of the virtual machine; determine a set of differences between the initial state and a baseline state; connect the virtual machine to the network; and upon detection of an occurrence of an event of the set of events; determine a current state of the virtual machine; determine, based at least in part on the current state, the baseline state, and the set of differences, a set of changes between the current state and the initial state, the set of changes usable at least in part to recreate the current state of the virtual machine; store the set of changes, resulting in a stored set of changes; terminate the virtual machine; and instantiate another virtual machine in accordance with the configuration. - View Dependent Claims (14, 15, 16, 17, 18, 19, 20, 21, 22, 23)
-
Specification