Systems and methods for auditing a virtual machine
AssigneeBitdefender IPR Management Ltd.
InventorsSandor Lukacs, Andrei V. Lutas, Ionel C. Anichitei
Life of this patent
Estimating the term…
Abstract
Described systems and methods enable performing software audits remotely and automatically, on a relatively large number of client systems (e.g., a corporate network, a virtual desktop infrastructure system, etc.) An audit engine executes on each client system, in a hardware virtualization configuration wherein the audit engine executes outside an audited virtual machine. When receiving an audit request from an audit server, some embodiments of the audit engine drop an audit agent into the audited virtual machine, and remove the audit agent upon completion of the audit.
Claims17
A computer system comprising at least one hardware processor and a memory, the at least one hardware processor configured to execute a set of guest virtual machines (VM) and a VM audit engine, the VM audit engine executing outside of the set of guest VMs and configured to:
- in response to receiving an audit request from a remote audit server, insert an audit agent into a target VM of the set of guest VMs, the target VM currently executing on the computer system;
- in response to the target VM executing the audit agent, remove the audit agent from the target VM;
- in response to removing the audit agent from the target VM, and in response to receiving another audit request from the remote audit server, insert another audit agent into another VM of the set of guest VMs currently executing on the computer system;
- and
- in response to the other VM executing the other audit agent, remove the other audit agent from the other VM;
- wherein the audit agent is configured to transmit a list of computer programs installed for execution within the target VM to the VM audit engine for further transmission to the audit server;
- wherein the other audit agent is configured to transmit another list of computer programs installed for execution within the other VM to the VM audit engine for further transmission to the audit server;
- and
- wherein inserting the audit agent comprises writing at least a part of the audit agent to a section of the memory allocated to another software object executing within the target VM.
A method of auditing a computer system, the method comprising employing at least one hardware processor of the computer system to execute a virtual machine (VM) audit engine outside of a set of guest VMs executing on the computer system, wherein executing the VM audit engine comprises:
- in response to receiving an audit request from a remote audit server, inserting an audit agent into a target VM of the set of guest VMs currently executing on the computer system;
- in response to the target VM executing the audit agent, removing the audit agent from the target VM;
- in response to removing the audit agent from the target VM, and in response to receiving another audit request from the remote audit server, inserting another audit agent into another VM of the set of guest VMs currently executing on the computer system;
- and
- in response to the other VM executing the other audit agent, removing the other audit agent from the other VM;
- wherein the audit agent is configured to transmit a list of computer programs installed for execution within the target VM to the VM audit engine for further transmission to the audit server;
- wherein the other audit agent is configured to transmit another list of computer programs installed for execution within the other VM to the VM audit engine for further transmission to the audit server;
- and
- wherein inserting the audit agent comprises writing at least a part of the audit agent to a section of a memory of the computer system, the section allocated to another software object executing within the target VM.
A non-transitory computer-readable medium storing instructions which, when executed by at least one hardware processor of a computer system, cause the computer system to form a virtual machine (VM) audit engine, the VM audit engine executing outside a set of guest VMs exposed on the computer system, the VM audit engine configured to:
- in response to receiving an audit request from a remote audit server, insert an audit agent into a target VM of the set of guest VMs currently executing on the computer system;
- in response to the target VM executing the audit agent, remove the audit agent from the target VM;
- in response to removing the audit agent from the target VM, and in response to receiving another audit request from the remote audit server, insert another audit agent into another VM of the set of guest VMs currently executing on the computer system;
- and
- in response to the other VM executing the other audit agent, remove the other audit agent from the other VM;
- wherein the audit agent is configured to transmit a list of computer programs installed for execution within the target VM to the VM audit engine for further transmission to the audit server;
- wherein the other audit agent is configured to transmit another list of computer programs installed for execution within the other VM to the VM audit engine for further transmission to the audit server;
- and
- wherein inserting the audit agent comprises writing at least a part of the audit agent to a section of a memory of the computer system, the section allocated to another software object executing within the target VM.
Dependencies are inferred from the claim text.