# US 11,113,086 B1 · Virtual system and method for securing external network connectivity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,113,086 B1 - Document ID: US11113086B1 - Status: Granted - Kind: B1 - Application number: 15/199,873 - Filed: 2016-06-30 - Granted: 2021-09-07 - Earliest claimed: 2015-06-30 - Assignees: FireEye, Inc. - Applicants: FireEye, Inc. - Inventors: Udo Steinberg - Web page: https://patentgrep.com/patent/US11113086B1 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 11/301: {where the computing system is a virtual computing platform, e.g. logically partitioned systems (virtual machines G06F9/45533; logical partitioning of resources G06F9/5077)} - G06F 11/3495: {for systems} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45591: {Monitoring or debugging support} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F 2201/84: Using snapshots, i.e. a logical point-in-time copy of the data - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract According to one embodiment, a computing device comprises one or more hardware processor and a memory coupled to the one or more processors. The memory comprises software that supports a virtualization software architecture including a first virtual machine operating under control of a first operating system. Responsive to determining that the first operating system has been compromised, a second operating system, which is stored in the memory in an inactive (dormant) state, is now active and controlling the first virtual machine or a second virtual machine different from the first virtual machine that now provides external network connectivity. ## Claims ### Claim 1 A computing device comprising: one or more hardware processors; and a memory coupled to the one or more hardware processors, the memory comprises one or more software components that, when executed by the one or more hardware processors, operate as (i) a visualization layer deployed in a host environment of a virtualization software architecture and (ii) a plurality of virtual machines deployed within a guest environment of the virtualization software architecture, the plurality of virtual machines comprises (a) a first virtual machine that is operating under control of a first operating system and including an agent collecting runtime state information of a network adapter and (b) a second virtual machine that is separate from the first virtual machine and is operating under control of a second operating system in response to determining that the first operating system has been compromised, the second virtual machine being configured to drive the network adapter, wherein after receipt of the state information by the virtualization layer, transmitting at least a portion of the state information to a threat protection component being deployed within the virtualization layer, analyzing, by the threat protection component, the state information to determine whether the first operating system is compromised by at least determining whether (i) an external network connection through the network adapter has been disabled or (ii) a kernel of the first operating system is attempting to disable the external network connection through the network adapter, and upon receipt of the results of the analyzing by the threat protection component that the first operating system is compromised, signaling, by the virtualization layer, to halt operations of the first virtual machine, installing, by the virtualization layer, a second operating system image retained within the memory of the computing device into the second virtual machine, reassigning, by the virtualization layer, the network adapter and adapter resources to the second operating system, the second virtual machine configured to drive the network adapter, and booting the second virtual machine subsequent to the reassignment of the network adapter and the adapter resources from the first operating system to the second operating system. ### Claim 2 (depends on 1) The computing device of claim 1, wherein the network adapter is configured to establish an external network connection to another computing device. ### Claim 3 (depends on 1) The computing device of claim 1, wherein the memory comprises software, including the one or more software components that, when executed by the one or more hardware processors, operates as the virtualization software architecture that comprises the guest environment including the first virtual machine and the host environment including the virtualization layer that analyzes data provided from the first virtual machine to determine whether the first operating system has been compromised. ### Claim 4 (depends on 3) The computing device of claim 3, wherein the virtualization layer in the host environment comprises (1) a guest monitor component that determines whether an event, received from a process running on the first virtual machine that is configured to monitor operability of the network adapter, is directed to disabling or disrupting functionality of the network adapter and (2) a threat protection component that determines that the first operating system is compromised if the event is classified as malicious. ### Claim 5 (depends on 4) The computing device of claim 4, wherein an event of the one or more events is classified as malicious upon determining that the event represents that an external network connection via the network adapter has been disabled. ### Claim 6 (depends on 4) The computing device of claim 4, wherein the event is classified as malicious upon determining that a kernel of the first operating system is attempting to disable the external network connection via the network adapter. ### Claim 7 (depends on 3) The computing device of claim 3, wherein the virtualization layer in the host environment comprises a threat protection component that determines that the first operating system is compromised when the one or more events is classified as malicious upon determining that the first operating system is non-functional. ### Claim 8 (depends on 3) The computing device of claim 3, wherein the virtualization layer in the host environment comprises a threat protection component that determines that the first operating system (OS) is compromised when the one or more events is classified as malicious upon determining that a guest OS application of the first operating system is inoperable. ### Claim 9 (depends on 1) The computing device of claim 1, wherein the second virtual machine is configured by removal of a first operating system (OS) kernel and one or more guest OS applications of the first operating system and installation of a second OS kernel and one or more guest OS applications of the second operating system. ### Claim 10 (depends on 1) The computing device of claim 1, wherein the first virtual machine transitioning from an active state to an inactive state when the first operating system is determined to be compromised. ### Claim 11 (depends on 1) The computing device of claim 1, wherein the first operating system is a different type of operating system than the second operating system. ### Claim 12 (depends on 1) The computing device of claim 1, wherein the network adapter corresponds to a software-emulated data transfer device. ### Claim 13 A non-transitory storage medium that includes software that is executable by one or more processors and, upon execution, operates a virtualization software architecture, the non-transitory storage medium comprising: one or more software components that, when executed by the one or more processors, operate as a network adapter; one or more software components that, when executed by the one or more processors, operate as a virtualization layer; one or more software components that, when executed by the one or more processors, operate as a first virtual machine being part of the virtualization software architecture, the first virtual machine operating under control of a first operating system and including an agent collecting runtime state information of a network adapter; and one or more software components that, when executed by the one or more processors, operate as a second virtual machine being part of the virtualization software architecture, the second virtual machine operating under control of a second operating system in response to determining that the first operating system has been compromised in which functionality of the first operating system is determined to have been altered or network connectivity by the first virtual machine has been disabled, wherein after receipt of the state information by the virtualization layer, transmitting at least a portion of the state information to a threat protection component being deployed within the virtualization layer, analyzing, by the threat protection component, the state information to determine whether the first operating system is compromised by at least determining whether (i) an external network connection through the network adapter has been disabled or (ii) a kernel of the first operating system is attempting to disable the external network connection through the network adapter, and upon receipt of the results of the analyzing by the threat protection component that the first operating system is compromised, signaling, by the virtualization layer, to halt operations of the first virtual machine, installing, by the virtualization layer, a second operating system image retained within the memory of the computing device into the second virtual machine, reassigning, by the virtualization layer, the network adapter and adapter resources to the second operating system, the second virtual machine configured to drive the network adapter, and booting the second virtual machine subsequent to the reassignment of the network adapter and the adapter resources from the first operating system to the second operating system. ### Claim 14 (depends on 13) The non-transitory storage medium of claim 13, wherein the virtualization layer analyzes data provided from the first virtual machine to determine whether the first operating system has been compromised. ### Claim 15 (depends on 14) The non-transitory storage medium of claim 14, wherein the virtualization layer determines that the first operating system has been compromised based on a state of functionality of the network adapter in communications with the first operating system of the first virtual machine. ### Claim 16 (depends on 14) The non-transitory storage medium of claim 14, wherein the virtualization layer comprises (1) a guest monitor component that determines whether one or more events, which are received from a process running on the first virtual machine that is configured to monitor operability of a network adapter in communications with the first operating system of the first virtual machine, is malicious as being directed to disabling or disrupting functionality of the network adapter and (2) the threat protection component that determines that the first operating system is compromised if the one or more events are classified as malicious. ### Claim 17 (depends on 16) The non-transitory storage medium of claim 16, wherein the threat protection component classifies the one or more events as malicious upon determining that the one or more events represent that external network connection via the network adapter has been disabled. ### Claim 18 (depends on 16) The non-transitory storage medium of claim 16, wherein the threat protection component classifies the one or more events as malicious upon determining that either (i) the first operating system is non-functional or (ii) an operability of a guest OS application of the first operating system has ceased. ### Claim 19 (depends on 16) The non-transitory storage medium of claim 16, wherein the threat protection component classifies the one or more events as malicious upon determining that a kernel of the first operating system is attempting to disable the external network connection via the network adapter. ### Claim 20 (depends on 13) The non-transitory storage medium of claim 13, wherein the second virtual machine is configured by removal of a first operating system (OS) kernel and one or more guest OS applications of the first operating system and installation of a second OS kernel and one or more guest OS applications of the second operating system. ### Claim 21 (depends on 13) The non-transitory storage medium of claim 13, wherein the first virtual machine is independent from the second virtual machine. ### Claim 22 (depends on 13) The non-transitory storage medium of claim 13, wherein the second virtual machine is a reconfiguration of the first virtual machine. ### Claim 23 A computerized method for protecting connectivity of a computing device to an external network in response to a virtualization layer of the computing device detecting that a guest operating system of the computing device has been compromised by a potential malicious attack through malware, the method comprising: operating a first virtual machine under control of a first operating system, the first virtual machine in communication with a network adapter and an agent collecting runtime state information of a network adapter; responsive to receipt of the state information by the virtualization layer, transmitting at least a portion of the state information to a threat protection component being deployed within the virtualization layer operating within a host environment of the computing device; analyzing, by the threat protection component, the state information to determine whether the first operating system is compromised by at least determining whether (i) an external network connection through the network adapter has been disabled or (ii) a kernel of the first operating system is attempting to disable the external network connection through the network adapter; and upon receipt of the results of the analyzing by the threat protection component that the first operating system is compromised, signaling, by the virtualization layer, to halt operations of the first virtual machine, installing, by the virtualization layer, a second operating system image retained within memory of the computing device into a second virtual machine, the second virtual machine being separate from the first virtual machine and allocated to a different address space than allocated to the first virtual machine, reassigning, by the virtualization layer, the network adapter and adapter resources to the second operating system, the second virtual machine configured to drive the reassigned network adapter, and booting the second virtual machine subsequent to the reassignment of the network adapter and the adapter resources from the first operating system to the second operating system. ### Claim 24 (depends on 23) The computerized method of claim 23 further comprising: conducting a boot process on the second virtual machine so that external network connectivity, as driven by the second operating system of the second virtual machine, is in operation. ### Claim 25 (depends on 23) The computerized method of claim 23, wherein the virtualization layer determines that the first operating system has been compromised based on a state of functionality of the network adapter in communications with the first operating system of the first virtual machine. ### Claim 26 (depends on 23) The computerized method of claim 23, wherein the virtualization layer comprises (1) a guest monitor component that determines whether one or more events corresponding to the state information being received from the agent configured to monitor operability of the network adapter, are being directed to disabling or disrupting functionality of the network adapter and (2) the threat protection component that determines that the first operating system is compromised if the one or more events are classified as malicious. ### Claim 27 (depends on 26) The computerized method of claim 26, wherein the threat protection component classifies the one or more events as malicious upon determining that the one or more events represent that external network connection via the network adapter has been disabled. ### Claim 28 (depends on 27) The computerized method of claim 27, wherein the threat protection component classifies the one or more events as malicious upon determining that either (i) the first operating system is non-functional or (ii) an operability of a guest operating system (OS) application of the first operating system has ceased. ### Claim 29 (depends on 26) The computerized method of claim 26, wherein the threat protection component classifies the one or more events as malicious upon determining that the kernel of the first operating system is attempting to disable the external network connection via the network adapter. ### Claim 30 (depends on 23) The computerized method of claim 23, wherein the second virtual machine is configured by removal of at least the kernel of the first operating system and installation of a kernel of the second operating system.