Virtual system and method for securing external network connectivity

A non-transitory storage medium that includes software that is executable by one or more processors and, upon execution, operates a virtualization software architecture, the non-transitory storage medium comprising:

• one or more software components that, when executed by the one or more processors, operate as a network adapter;
• one or more software components that, when executed by the one or more processors, operate as a virtualization layer;
• one or more software components that, when executed by the one or more processors, operate as a first virtual machine being part of the virtualization software architecture, the first virtual machine operating under control of a first operating system and including an agent collecting runtime state information of a network adapter;
• and
• one or more software components that, when executed by the one or more processors, operate as a second virtual machine being part of the virtualization software architecture, the second virtual machine operating under control of a second operating system in response to determining that the first operating system has been compromised in which functionality of the first operating system is determined to have been altered or network connectivity by the first virtual machine has been disabled,
• wherein after receipt of the state information by the virtualization layer,
• transmitting at least a portion of the state information to a threat protection component being deployed within the virtualization layer,
• analyzing, by the threat protection component, the state information to determine whether the first operating system is compromised by at least determining whether (i) an external network connection through the network adapter has been disabled or (ii) a kernel of the first operating system is attempting to disable the external network connection through the network adapter, and
• upon receipt of the results of the analyzing by the threat protection component that the first operating system is compromised,
• signaling, by the virtualization layer, to halt operations of the first virtual machine,
• installing, by the virtualization layer, a second operating system image retained within the memory of the computing device into the second virtual machine,
• reassigning, by the virtualization layer, the network adapter and adapter resources to the second operating system, the second virtual machine configured to drive the network adapter, and
• booting the second virtual machine subsequent to the reassignment of the network adapter and the adapter resources from the first operating system to the second operating system.

A computerized method for protecting connectivity of a computing device to an external network in response to a virtualization layer of the computing device detecting that a guest operating system of the computing device has been compromised by a potential malicious attack through malware, the method comprising:

• operating a first virtual machine under control of a first operating system, the first virtual machine in communication with a network adapter and an agent collecting runtime state information of a network adapter;
• responsive to receipt of the state information by the virtualization layer, transmitting at least a portion of the state information to a threat protection component being deployed within the virtualization layer operating within a host environment of the computing device;
• analyzing, by the threat protection component, the state information to determine whether the first operating system is compromised by at least determining whether (i) an external network connection through the network adapter has been disabled or (ii) a kernel of the first operating system is attempting to disable the external network connection through the network adapter;
• and
• upon receipt of the results of the analyzing by the threat protection component that the first operating system is compromised,
• signaling, by the virtualization layer, to halt operations of the first virtual machine,
• installing, by the virtualization layer, a second operating system image retained within memory of the computing device into a second virtual machine, the second virtual machine being separate from the first virtual machine and allocated to a different address space than allocated to the first virtual machine,
• reassigning, by the virtualization layer, the network adapter and adapter resources to the second operating system, the second virtual machine configured to drive the reassigned network adapter, and
• booting the second virtual machine subsequent to the reassignment of the network adapter and the adapter resources from the first operating system to the second operating system.