Identification of Unauthorized Code Running in an Operating System's Kernel

A computer program embedded in a computer-readable storage medium, which when executed by one or more processors, configured to manage execution of a running-page in a virtual machine running on a first host, the computer program comprising:

• program instructions for associating an execution trace code with the running-page, wherein the execution trace code generates a notification upon initiation of the execution of the running-page by the virtual machine;
• program instructions for receiving the notification at a security virtual machine, the security virtual machine executing on a second host that is distinct from the first host;
• program instructions for validating the running-page associated with the execution trace code as authorized for execution, wherein the validation is performed by the security virtual machine;
• and
• program instructions for generating an exception if the running-page is not authorized for execution, wherein the security virtual machine generates the exception to prevent the execution of the running-page in the virtual machine.

A system for managing execution of a running-page in a virtual machine on a host within a managed cluster of virtual machines, the system comprising:

• a) a virtual security interface in the virtual machine, the virtual security interface configured to detect initiation of an execution of a running-page, monitor security events at the virtual machine, inspect state of virtual hardware associated with the virtual machine, apply updates to software available at virtual hard drive associated with the virtual machine, receive and update security policies at the virtual machine;
• b) an external security agent deployed at the host for the virtual machine to manage execution of the running-page at the virtual machine, the external security agent configured to enforce security policies, monitor execution and modification of the running-page, assist in the verification of the running-page, and trigger a security event if verification of running-page is unsuccessful;
• and
• c) a security server virtual machine within the managed cluster that is different from the virtual machine, the security server virtual machine having an intercept verification engine, the intercept verification engine configured to introduce one of an execution trace code or write trace code in the running-page, validate contents of the running-page upon initiation for execution at the virtual machine, report security events triggered at the running-page and manage security policy for the managed cluster including updates to the security policy.

A computer implemented method for managing execution of a running-page in a virtual machine, comprising:

• introducing an execution trace code at the running-page by a security virtual machine that is independent of the virtual machine executing the running-page, wherein the execution trace code generates a notification to the security virtual machine upon initiation of the execution of the running-page by the virtual machine;
• validating the running-page associated with the execution trace code as authorized for execution upon receiving a notification indicative of the initiation of the execution of the running-page, wherein the validation performed by the security virtual machine;
• replacing the execution trace code with a write trace code to monitor modification to the running-page, if the running-page is authorized for execution, and permitting execution of the running-page in the virtual machine;
• determining any modification to the running-page at the security virtual machine during execution in the virtual machine, the modification determined through receipt of a notification from the write trace code;
• replacing the write trace code for the modified running-page with the execution trace code so as to initiate validation of the modified running-page when the modified running-page is subsequently executed by the virtual machine, wherein the replacing of the write trace code for the modified running-page is performed by the security virtual machine;
• incrementing a flip count for the running-page by the security virtual machine when the write trace code is replaced by the execution trace code;
• monitoring the flipping between execution trace code and the write code for the running-page, wherein the security virtual machine monitors the flipping;
• and
• permitting the execution of the running-page by the security virtual machine based on the monitoring of the flipping.

A computer implemented method for managing execution of a running-page in a virtual machine, comprising:

• associating an execution trace code with the running-page, wherein the execution trace code generates a notification upon initiation of the execution of the running-page by the virtual machine;
• receiving the notification, wherein the notification is received by a security virtual machine running independent of the virtual machine executing the running-page;
• validating the running-page associated with the execution trace code as authorized for execution by the security virtual machine, wherein the validation further includes,
• comparing contents of the running-page with contents of a plurality of authorized pages for execution, the comparing of the contents performed by identifying a subgroup of authorized pages, wherein each page includes one or more static portions and one or more dynamic portions;
• finding a match of the running-page within the identified subgroup of authorized pages using a hash value;
• and
• generating an exception if the running-page is not authorized for execution, wherein the security virtual machine generates the exception to prevent the execution of the running-page in the virtual machine.