Systems and methods for decrypting network traffic in a virtualized environment

A method of monitoring a communication session carried out between a virtual machine executing on a computer system and a remote party, the method comprising employing at least one processor of the computer system to execute a security component and a network filter, the network filter and security component executing outside the virtual machine, wherein:

• the communication session comprises sending or receiving a handshake message and an encrypted payload, wherein the handshake message comprises a cryptographic parameter, wherein the encrypted payload is encrypted according to the cryptographic parameter;
• the network filter controls a network adapter of the computer system and is configured to intercept the handshake message and in response, to transmit a notification to the security component;
• and
• executing the security component comprises:
• in response to the notification, selecting a memory page from a plurality of memory pages used by the virtual machine according to whether the memory page has been written to during a time interval between a detection of a first session event of the communication session and a detection of a second session event of the communication session, and
• in response to selecting the memory page, transmitting a content of the memory page to a decryption engine configured to decrypt the encrypted payload according to the content.

A non-transitory computer-readable medium storing instructions which, when executed by a hardware processor of a computer system, cause the computer system to form a network filter and a security component, the network filter and security component executing outside of a virtual machine executing on the computer system, the virtual machine configured to carry out a communication session with a remote party, the communication session comprising sending or receiving a handshake message and an encrypted payload, wherein the handshake message comprises a cryptographic parameter, wherein the encrypted payload is encrypted according to the cryptographic parameter, wherein:

• the network filter controls a network adapter of the computer system and is configured to intercept the handshake message and in response, to transmit a notification to the security component;
• and
• the security component is configured to:
• in response to the notification, select a memory page from a plurality of memory pages used by the virtual machine according to whether the memory page has been written to during a time interval between a detection of a first session event of the communication session and a detection of a second session event of the communication session, and
• in response to selecting the memory page, transmit a content of the memory page to a decryption engine configured to decrypt the encrypted payload according to the content.