Malware-Resistant Application Control in Virtualized Environments

A method comprising employing at least one hardware processor of a client system to execute an application control engine outside of a set of guest virtual machines (VM) exposed on the client system, wherein executing the application control engine comprises:

• detecting an event indicative of a launch of a target process within a guest VM of the set of guest VMs, wherein the event comprises an item selected from a group consisting of setting up a virtual memory space for the target process, and writing to a data structure used by the at least one hardware processor to perform memory address translations for the target process;
• in response to detecting the event, determining according to an application control policy whether the target process is allowed to execute on the client system, wherein the application control policy maps allowed processes to users of the client system;
• and
• in response to determining whether the target process is allowed to execute, when the target process is not allowed to execute, preventing an execution of the target process.

A server computer system comprising at least one hardware processor configured to:

• receive from a client system an indicator of a target process;
• and
• in response, transmit an application control policy to the client system, the application control policy mapping computer programs to users of the client system,
• wherein the client system is configured to execute a set of guest virtual machines (VM) and to further execute an application control engine, the application control engine executing outside the set of guest VMs, the application control engine configured to:
• detect an event indicative of a launch of a target process within a guest VM of the set of guest VMs, wherein the event comprises an item selected from a group consisting of setting up a virtual memory space for the target process, and writing to a data structure used by the at least one hardware processor to perform memory address translations for the target process;
• in response to detecting the event, determine according to the application control policy whether the target process is allowed to execute on the computer system, and
• in response to determining whether the target process is allowed to execute, when the target process is not allowed to execute, prevent an execution of the target process.

A non-transitory computer-readable medium storing instructions which, when executed by at least one hardware processor of a computer system configured to execute a set of guest virtual machines (VM), cause the computer system to execute an application control engine, the application control engine executing outside the set of guest VMs, the application control engine configured to:

• detect an event indicative of a launch of a target process within a guest VM of the set of guest VMs, wherein the event comprises an item selected from a group consisting of setting up a virtual memory space for the target process, and writing to a data structure used by the at least one hardware processor to perform memory address translations for the target process;
• in response to detecting the event, determine according to an application control policy whether the target process is allowed to execute on the computer system, wherein the application control policy maps allowed processes to users of the computer system;
• and
• in response to determining whether the target process is allowed to execute, when the target process is not allowed to execute, prevent an execution of the target process.