SECURITY EVENT DETECTION THROUGH VIRTUAL MACHINE INTROSPECTION

• US 20160241573A1
• Filed: 02/13/2015
• Published: 08/18/2016
• Est. Priority Date: 02/13/2015
• Status: Active Grant

• Current Assignee: Fisher-Rosemount Systems Incorporated (Emerson Electric Company)
• Original Assignee: Fisher-Rosemount Systems Incorporated (Emerson Electric Company)
• Inventors: Mixer, Robert A.
• Granted Patent: US 10,944,764 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and apparatus are disclosed for security event detection through virtual machine introspection. Example methods involve monitoring usage of a plurality of resources by a first virtual machine executing on a computing device by a monitoring agent, the monitoring agent executing on the computing device separate from the first virtual machine. Example methods further involve detecting a potential security event by comparing the usage of the plurality of resources to resource usage patterns. Example methods further involve assigning a severity level to the detected potential security event, and initiating a security action defined for the assigned severity level.

Claims

1. A method of security event detection in a computing device of a process control system, comprising:

monitoring usage of a plurality of resources by a first virtual machine executing on the computing device by a monitoring agent, the monitoring agent executing on the computing device separate from the first virtual machine;

detecting a potential security event by comparing the usage of the plurality of resources to resource usage patterns;

assigning a severity level to the detected potential security event; and

initiating a security action based on the assigned severity level.

2. A method as defined in claim 1, wherein the monitoring agent communicates with a hypervisor managing the first virtual machine to monitor the usage of the plurality of resources by the first virtual machine.

3. A method as defined in claim 1, wherein the monitoring agent is executing in a second virtual machine on the computing device.

4. A method as defined in claim 1, wherein the monitoring agent is part of a hypervisor that manages the first virtual machine.

5. A method as defined in claim 1, wherein monitoring agent monitors at least one of memory usage, storage disk usage, network usage, and hardware usage of the first virtual machine.

6. A method as defined in claim 1, wherein, in response to assigning a highest severity level to the detected potential security event, initiating the security action comprises:

causing a second virtual machine to instantiate on the computing device based on a snapshot of the first virtual machine created before the potential security event was detected;

migrating functionality of the first virtual machine to the second virtual machine; and

terminating the first virtual machine.

7. A method as defined in claim 1, further comprising:

assigning an integrity level to the first virtual machine;

in response to detecting the potential security event, reducing the integrity level of the first virtual machine; and

when the integrity level of the first virtual machine is below an integrity level threshold, initiating the security action based on the integrity level of the first virtual machine.

8. An apparatus comprising:

a resource monitor to, via a processor;

monitor usage of a plurality of resources by a first virtual machine executing on a computing device, the resource monitor being separate from the first virtual machine, and

detect a potential security event by comparing the usage of the plurality of resources to resource usage patterns; and

a security event handler to;

assign a severity level to the detected potential security event, and

initiate a security action defined for the assigned severity level.

9. An apparatus as defined in claim 8, wherein the resource monitor is to communicate with a hypervisor managing the first virtual machine to monitor the usage of the plurality of resources of the first virtual machine.

10. An apparatus as defined in claim 8, wherein the resource monitor is part of a hypervisor that manages the first virtual machine.

11. An apparatus as defined in claim 8, wherein resource monitor is to monitor at least one of memory usage, storage disk usage, network usage, and hardware usage of the first virtual machine.

12. An apparatus as defined in claim 8, wherein, in response to assigning a highest severity level to the detected potential security event, the security event handler is to:

cause a second virtual machine to instantiate on the computing device based on a snapshot of the first virtual machine created before the potential security event was detected;

migrate functionality of the first virtual machine to the second virtual machine; and

terminate the first virtual machine.

13. An apparatus as defined in claim 8, wherein the security event handler is to:

assign an integrity level to the first virtual machine;

in response to detecting potential security event, reduce the integrity level of the first virtual machine; and

when the integrity level of the first virtual machine is below an integrity level threshold, initiate a security action based on the integrity level of the first virtual machine.

14. A tangible computer readable storage medium comprising instructions which, when executed, cause a monitoring agent to at least:

monitor usage of a plurality of resources by a first virtual machine executing on a computing device, the monitoring agent to execute on the computing device separate from the first virtual machine;

detect a potential security event by comparing the usage of the plurality of resources to resource usage patterns;

assign a severity level to the detected potential security event; and

initiate a security action defined for the assigned severity level.

15. A tangible computer readable storage medium as defined in claim 14, wherein the instructions, when executed, cause the monitoring agent further to communicate with a hypervisor managing the first virtual machine to monitor the usage of the plurality of resources of the first virtual machine.

16. A tangible computer readable storage medium as defined in claim 14, wherein the monitoring agent is to execute in a second virtual machine on the computing device.

17. A tangible computer readable storage medium as defined in claim 14, wherein the monitoring agent is part of a hypervisor that manages the first virtual machine.

18. A tangible computer readable storage medium as defined in claim 14, wherein the instructions, when executed, cause the monitoring agent to monitor at least one of memory usage, storage disk usage, network usage, and hardware usage of the first virtual machine.

19. A tangible computer readable storage medium as defined in claim 14, wherein, in response to assigning a highest severity level to the detected potential security event, the instructions, when executed, cause the monitoring agent to:

cause a second virtual machine to instantiate on the computing device based on a snapshot of the first virtual machine created before the potential security event was detected;

migrate functionality of the first virtual machine to the second virtual machine; and

terminate the first virtual machine.

20. A tangible computer readable storage medium as defined in claim 14, comprising instructions that, when executed, cause the monitoring agent to:

assign an integrity level to the first virtual machine;

in response to detecting potential security event, reduce the integrity level of the first virtual machine; and

when the integrity level of the first virtual machine is below an integrity level threshold, initiate a security action based on the integrity level of the first virtual machine.