# US 12,182,604 B2 · Behavior-based VM resource capture for forensics > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,604 B2 - Document ID: US12182604B2 - Status: Granted - Kind: B2 - Application number: 18/048,532 - Filed: 2022-10-21 - Published: 2023-02-23 - Granted: 2024-12-31 - Earliest claimed: 2019-08-16 - Assignees: Google Inc. - Applicants: Google LLC - Inventors: Michael Halcrow; Thomas Garnier - Web page: https://patentgrep.com/patent/US12182604B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - G06F 9/5088: {involving task migration} - G06F 11/1469: {Backup restoration techniques} - G06F 12/1491: {in a hierarchical protection system, e.g. privilege levels, memory rings} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2201/84: Using snapshots, i.e. a logical point-in-time copy of the data - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for capturing VM resources for forensics includes receiving an indication of compromise (IoC). The indication of compromise indicates an attack is imminent against a virtual machine. The method also includes, in response to receiving the IoC and before the attack begins, snapshotting a memory state of memory used by the virtual machine and increasing a level of auditing of the virtual machine from a standard level of auditing to a heightened level of auditing. The heightened level of auditing generates data representative of all accesses to the memory used by the virtual machine. After the attack against the virtual machine has begun, the method includes maintaining the heightened level of auditing for a threshold period of time, notifying a user of the virtual machine of the indication of compromise, and storing the data in memory external to the virtual machine. ## Claims ### Claim 1 A computer-implemented method executed by data processing hardware that causes the data processing hardware to perform operations comprising: monitoring, using a standard level of auditing, one or more processes of a virtual machine; based on monitoring the one or more processes, detecting aberrant behavior indicating that an attack against the virtual machine is imminent; in response to detecting the aberrant behavior indicating that the attack is imminent, monitoring, using a heightened level of auditing, the one or more processes of the virtual machine, the heightened level of auditing generating log data representative of memory accesses performed by the virtual machine; notifying a user of the virtual machine that the imminent attack is detected; during the attack against the virtual machine, maintaining the monitoring of the one or more processes of the virtual machine using the heightened level of auditing; determining that the attack against the virtual machine has concluded; and in response to determining that the attack against the virtual machine has concluded: recording a snapshot of a state of the virtual machine; reconstructing, using the log data and the snapshot, a state of the virtual machine at a point in time during the attack against the virtual machine; and monitoring, using the standard level of auditing, the one or more processes of the virtual machine. ### Claim 2 (depends on 1) The method of claim 1, wherein the operations further comprise, in response to detecting the aberrant behavior indicating that the attack is imminent, recording a snapshot of the state of the virtual machine. ### Claim 3 (depends on 1) The method of claim 1, wherein recording a snapshot of the state of the virtual machine comprises recording a volatile-memory state of a volatile-memory used by the virtual machine. ### Claim 4 (depends on 3) The method of claim 3, wherein recording the snapshot of the volatile-memory state comprises executing a live migration of the volatile-memory. ### Claim 5 (depends on 1) The method of claim 1, wherein recording a snapshot of the state of the virtual machine comprises recording a non-volatile memory state of non-volatile memory used by the virtual machine. ### Claim 6 (depends on 1) The method of claim 1, wherein the log data is representative of volatile and non-volatile memory accesses performed by the virtual machine. ### Claim 7 (depends on 6) The method of claim 6, wherein the log data comprises a list of all commands executed by the virtual machine during the heightened level of auditing. ### Claim 8 (depends on 1) The method of claim 1, wherein detecting the aberrant behavior comprises receiving an indication of compromise from an intrusion detection system executing on the data processing hardware. ### Claim 9 (depends on 8) The method of claim 8, wherein the intrusion detection system executes in a first hierarchical protection domain and software resources within a user space of the virtual machine executes in a second hierarchical protection domain. ### Claim 10 (depends on 9) The method of claim 9, wherein the first hierarchical protection domain has more privileges than the second hierarchical protection domain. ### Claim 11 A system comprising: data processing hardware; and memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising: monitoring, using a standard level of auditing, one or more processes of a virtual machine; based on monitoring the one or more processes, detecting aberrant behavior indicating that an attack against the virtual machine is imminent; in response to detecting the aberrant behavior indicating that the attack is imminent, monitoring, using a heightened level of auditing, the one or more processes of the virtual machine, the heightened level of auditing generating log data representative of memory accesses performed by the virtual machine; notifying a user of the virtual machine that the imminent attack is detected; during the attack against the virtual machine, maintaining the monitoring of the one or more processes of the virtual machine using the heightened level of auditing; determining that the attack against the virtual machine has concluded; and in response to determining that the attack against the virtual machine has concluded: recording a snapshot of a state of the virtual machine; and reconstructing, using the log data and the snapshot, a state of the virtual machine at a point in time during the attack against the virtual machine; and monitoring, using the standard level of auditing, the one or more processes of the virtual machine. ### Claim 12 (depends on 11) The system of claim 11, wherein the operations further comprise, in response to detecting the aberrant behavior indicating that the attack is imminent, recording a snapshot of the state of the virtual machine. ### Claim 13 (depends on 11) The system of claim 11, wherein recording a snapshot of the state of the virtual machine comprises recording a volatile-memory state of a volatile-memory used by the virtual machine. ### Claim 14 (depends on 13) The system of claim 13, wherein recording the snapshot of the volatile-memory state comprises executing a live migration of the volatile-memory. ### Claim 15 (depends on 11) The system of claim 11, wherein recording a snapshot of the state of the virtual machine comprises recording a non-volatile memory state of non-volatile memory used by the virtual machine. ### Claim 16 (depends on 11) The system of claim 11, wherein the log data is representative of volatile and non-volatile memory accesses performed by the virtual machine. ### Claim 17 (depends on 16) The system of claim 16, wherein the log data comprises a list of all commands executed by the virtual machine during the heightened level of auditing. ### Claim 18 (depends on 11) The system of claim 11, wherein detecting the aberrant behavior comprises receiving an indication of compromise from an intrusion detection system executing on the data processing hardware. ### Claim 19 (depends on 18) The system of claim 18, wherein the intrusion detection system executes in a first hierarchical protection domain and software resources within a user space of the virtual machine executes in a second hierarchical protection domain. ### Claim 20 (depends on 19) The system of claim 19, wherein the first hierarchical protection domain has more privileges than the second hierarchical protection domain.