# US 11,113,388 B2 · Cloud forensics and incident response platform

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,113,388 B2
- Document ID: US11113388B2
- Status: Granted
- Kind: B2
- Application number: 16/051,005
- Filed: 2018-07-31
- Published: 2020-02-06
- Granted: 2021-09-07
- Earliest claimed: 2018-07-31
- Assignees: National Technology & Engineering Solutions of Sandia, LLC
- Applicants: National Technology & Engineering Solutions of Sandia, LLC
- Inventors: Vincent Urias; Caleb Loverro; William M.S. Stout
- Web page: https://patentgrep.com/patent/US11113388B2

## CPC

- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications}
- G06F 9/545: {where tasks reside in different layers, e.g. user- and kernel-space}
- G06F 2009/45579: {I/O management, e.g. providing access to device drivers or storage}
- G06F 2009/45583: {Memory management, e.g. access or allocation}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2009/45591: {Monitoring or debugging support}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system, method, and device for cloud forensics and incident response is provided. In an embodiment, a computer-implemented method for performing cloud forensics and incident response includes intercepting, by a cloud incident response module (CIRM), communication between a virtual machine (VM) and a hypervisor. The method also includes extracting, by the CIRM, data from the communication between the VM and the hypervisor according to a forensic policy. Intercepting and extracting the data are transparent to the VM and to the hypervisor. Intercepting and extracting the data are independent of the VM and the hypervisor.

## Claims

### Claim 1

A computer-implemented method for performing cloud forensics and incident response, the computer-implemented method comprising:
intercepting, by a cloud incident response module (CIRM), communication between a virtual machine (VM) and a hypervisor; and
extracting, by the CIRM, data from the communication between the VM and the hypervisor according to a forensic policy,
wherein intercepting and the extracting are transparent to the VM and to the hypervisor,
wherein the intercepting and the extracting are performed without knowledge of the VM and of the hypervisor, and
wherein the intercepting and the extracting are performed independent of the VM.

### Claim 2 (depends on 1)

The method of claim 1, wherein the VM comprises a first VM, wherein the hypervisor comprises a first hypervisor, wherein the communication comprises a first communication, and wherein the data comprises a first data, further comprising:
intercepting, by the CIRM, second communication between a second VM and a second hypervisor; and
extracting, by the CIRM, second data from the second communication between the second VM and the second hypervisor.

### Claim 3 (depends on 2)

The method of claim 2, further comprising collecting and exporting the first and second data in a unified manner that is independent of the first and second VMs and independent of the first and second hypervisors.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
reconstructing binary data from the extracted data; and
analyzing the binary data to extract forensic information.

### Claim 5 (depends on 1)

The method of claim 1, wherein the data comprises textual data and further comprising:
correlating the textual data against other data in a security information and event management (SIEM) system.

### Claim 6 (depends on 1)

The method of claim 1, wherein the intercepting and extracting are performed without interruption of the VM and the hypervisor.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
detecting an operating system of the VM.

### Claim 8 (depends on 1)

The method of claim 1, wherein the forensic policy comprises at least one of an identifying a guest for which data is to be extracted, identifying a type of data to be extracted, and identifying a time frame within which data is to be extracted.

### Claim 9 (depends on 1)

The method of claim 1, further comprising:
locating, by the CIRM, hypervisor in kernel-space memory; and
redirecting exit handling of the VM from the hypervisor to a CIRM exit handler.

### Claim 10 (depends on 1)

The method of claim 1, wherein the CIRM is loadable and unloadable without VM or hypervisor interruption.

### Claim 11 (depends on 1)

The method of claim 1, wherein an output from the CIRM is unified across a plurality of hypervisors and a plurality of VMs.

### Claim 12

A computer system for performing cloud forensics and incident response, the computer system comprising:
a bus system;
a storage device connected to the bus system, wherein the storage device stores program instructions; and
a processor connected to the bus system, wherein the processor executes the program instructions to:
intercept communication between a virtual machine (VM) and a hypervisor; and
extract data from the communication between the VM and the hypervisor according to a forensic policy,
wherein executing the instructions to intercept and to extract are transparent to the VM and to the hypervisor,
wherein executing the instructions to intercept and extract are performed without knowledge of the VM and of the hypervisor, and
wherein the intercepting and the extracting are performed independent of the VM.

### Claim 13 (depends on 12)

The computer system of claim 12, wherein the VM comprises a first VM, wherein the hypervisor comprises a first hypervisor, wherein the communication comprises a first communication, wherein the data comprises a first data, and wherein the processor further executes the program instructions to:
intercept second communication between a second VM and a second hypervisor; and
extract second data from the second communication between the second VM and the second hypervisor.

### Claim 14 (depends on 12)

The computer system of claim 12, wherein the processor further executes the program instructions to:
reconstruct binary data from the extracted data; and
analyze the binary data to extract forensic information.

### Claim 15 (depends on 12)

The computer system of claim 12, wherein the data comprises textual data and wherein the processor further executes the program instructions to:
correlate the textual data against other data in a security information and event management (SIEM) system.

### Claim 16 (depends on 12)

The computer system of claim 12, wherein the instructions to intercept and the instructions to extract are performed without interruption of the VM and the hypervisor.

### Claim 17

A computer program product for performing cloud forensics and incident response, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:
intercepting communication between a virtual machine (VM) and a hypervisor; and
extracting data from the communication between the VM and the hypervisor according to a forensic policy,
wherein intercepting and the extracting are transparent to the VM and to the hypervisor,
wherein the intercepting and the extracting are performed without knowledge of the VM and of the hypervisor, and
wherein the intercepting and the extracting are performed independent of the VM.

### Claim 18 (depends on 17)

The computer program product of claim 17, wherein the VM comprises a first VM, wherein the hypervisor comprises a first hypervisor, wherein the communication comprises a first communication, wherein the data comprises a first data, and wherein the method further comprises:
intercepting second communication between a second VM and a second hypervisor; and
extracting second data from the second communication between the second VM and the second hypervisor.

### Claim 19 (depends on 17)

The computer program product of claim 17, wherein the method further comprises:
reconstructing binary data from the extracted data; and
analyzing the binary data to extract forensic information.

### Claim 20 (depends on 17)

The computer program product of claim 17, wherein the data comprises textual data and wherein the method further comprises:
correlating the textual data against other data in a security information and event management (SIEM) system.

### Claim 21 (depends on 17)

The computer program product of claim 17, wherein the method for intercepting and extracting are performed without interruption of the VM and the hypervisor.