Malicious packet filtering in a virtualization system

A system comprising:

• a memory;
• and
• a processing device coupled to the memory, the processing device to:
• receive, by a hypervisor that manages a first virtualized execution environment and a second virtualized execution environment and that is executed by the processing device, a first packet addressed to the first virtualized execution environment;
• determine, by the hypervisor, whether the first packet has similar characteristics with a second packet by applying a first filtering rule to the first packet, wherein the first filtering rule is generated by the hypervisor in view of characteristics of the second packet by accessing a second filtering queue within a second virtual network interface card (NIC) of the second virtualized execution environment that stores the second packet, wherein the second virtualized execution environment stores the second packet in the second filtering queue based on a determination by a second application of the second virtualized execution environment that the second packet is malicious, and wherein the second filtering queue is designated for malicious packets and provides an interface between a virtualization section of a host and the second virtualized execution environment;
• responsive to a determination that the first packet is similar to the second packet, discard, by the hypervisor, the first packet;
• access, by the hypervisor, a first filtering queue within a first virtual NIC of the first virtualized execution environment to obtain a fourth packet, the fourth packet stored in the first filtering queue based on a determination by a first application of the first virtualized execution environment that the fourth packet is malicious;
• generate, by the hypervisor in view of characteristics of the fourth packet, a third filtering rule based on the fourth packet;
• determine a threshold number of similar filtering rules is exceeded based on a determination the third filtering rule is similar to the first filtering rule and a second filtering rule;
• add at least one of the first filtering rule, the second filtering rule, or the third filtering rule to a physical NIC of a host associated with the hypervisor based on determining the threshold number of similar filtering rules is exceeded;
• and
• configure the physical NIC to apply the at least one of the first filtering rule, the second filtering rule, or the third filtering rule added to the physical NIC.

A non-transitory computer-readable medium storing instructions that, when executed by a processing device, cause the processing device to:

• receive, by a supervisor that manages a first virtualized execution environment and a second virtualized execution environment and that is executed by the processing device, a first packet addressed to the first virtualized execution environment;
• determine, by the supervisor, whether the first packet has similar characteristics with a second packet by applying a first filtering rule to the first packet, wherein the first filtering rule is generated by the supervisor in view of characteristics of the second packet by accessing a second filtering queue within a second software network interface card (NIC) of the second virtualized execution environment that stores the second packet, wherein the second virtualized execution environment stores the second packet in the second filtering queue based on a determination by a second application of the second virtualized execution environment that the second packet is malicious, and wherein the second filtering queue is designated for malicious packets and provides an interface between a virtualization section of a host and the second virtualized execution environment;
• responsive to a determination that the first packet is similar to the second packet, discard, by the supervisor, the first packet;
• access, by the supervisor, a first filtering queue within a first virtual NIC of the first virtualized execution environment to obtain a fourth packet, the fourth packet stored in the first filtering queue based on a determination by a first application of the first virtualized execution environment that the fourth packet is malicious;
• generate, by the supervisor in view of characteristics of the fourth packet, a third filtering rule based on the fourth packet;
• determine a threshold number of similar filtering rules is exceeded based on a determination the third filtering rule is similar to the first filtering rule and a second filtering rule;
• and
• add at least one of the first filtering rule, the second filtering rule, or the third filtering rule to a physical NIC of a host associated with the supervisor based on determining the threshold number of similar filtering rules is exceeded;
• and
• configure the physical NIC to apply the at least one of the first filtering rule, the second filtering rule, or the third filtering rule added to the physical NIC.