MODIFIED FILE TRACKING ON VIRTUAL MACHINES

• US 20100251363A1
• Filed: 03/24/2009
• Published: 09/30/2010
• Est. Priority Date: 03/24/2009
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Todorovic, Rade
• Granted Patent: US 9,177,145 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

In embodiments of the present invention improved capabilities are described for tracking modified files on a virtual machine including the steps of identifying an altered disk sector, associating the altered disk sector with code that is operated in a virtual machine, and causing a malicious code scan to be performed on the code.

Claims

1. A computer program product embodied in a computer readable medium that, when executing on one or more computers, performs the steps of:

identifying an altered disk sector;

associating the altered disk sector with data that are operated in a virtual machine; and

causing a malicious code scan to be performed on the data.

2. The computer program product of claim 1, wherein the step of identification is performed by examination of a dirty cluster map.

3. The computer program product of claim 1, wherein the data are at least one of a file, code, an executable file, a software application, and interpretable content.

4. A computer program product embodied in a computer readable medium that, when executing on one or more computers, performs the steps of:

identifying an altered disk sector;

associating the altered disk sector with data that are operated in a virtual machine; and

causing a malicious code scan to be performed on an operating system within the virtual machine based at least in part of finding that the data have been corrupted by malicious code.

5. The computer program product of claim 4, wherein the step of identification is performed by examination of a dirty cluster map.

6. The computer program product of claim 4, wherein the data are at least one of a file, code, an executable file, a software application, and interpretable content.

7. A computer program product embodied in a computer readable medium that, when executing on one or more computers, performs the steps of:

identifying an altered disk sector;

associating the altered disk sector with data that are operated in a virtual machine; and

causing a malicious code scan to be performed on a plurality of files within the virtual machine based at least in part on a finding that the data have been corrupted by malicious code.

8. The computer program product of claim 7, wherein the step of identification is performed by examination of a dirty cluster map.

9. The computer program product of claim 7, wherein the data are at least one of a file, code, an executable file, a software application, and interpretable content.

10. A computer program product embodied in a computer readable medium that, when executing on one or more computers, performs the steps of:

identifying an altered disk sector;

associating the altered disk sector with code that is operated in a virtual machine; and

causing a malicious code scan to be performed on a file generated by the code.

11. The computer program product of claim 10, wherein the file generated by the code is within the virtual machine.

12. The computer program product of claim 10, wherein the file generated by the code is outside of the virtual machine.

13. The computer program product of claim 10, wherein the step of identification is performed by examination of a dirty cluster map.

14. The computer program product of claim 13, wherein the dirty cluster map is a file that holds information about modified clusters on the virtual machine.

15. The computer program product of claim 10, wherein the code is at least one of a file, an executable file, a software application, and interpretable content.

16. A computer program product embodied in a computer readable medium that, when executing on one or more computers, performs the steps of:

identifying an altered disk sector;

associating the altered disk sector with data that are operated in a virtual machine;

causing a code scan to be performed on the data; and

in response to identifying that an acceptable change has been made to the data, causing an indication to be made representing the fact that similar changes may be desirable in other virtual machines.

17. The computer program product of claim 16, wherein multiple replica virtual machines exist on a platform and the indication of the acceptable change in one virtual machine indicates that the same change should be made in other replica virtual machines.

18. The computer program product of claim 16, wherein the step of identification is performed by examination of a dirty cluster map.

19. The computer program product of claim 18, wherein the dirty cluster map is a file that holds information about modified clusters on the virtual machine.

20. The computer program product of claim 16, wherein the data are at least one of a file, code, an executable file, a software application, and interpretable content.