US 2018/0293378 A1 · THREAT DEFENSE TECHNIQUES

Abstract

In an approach, an intermediary guest manager operates within a virtual machine hosted by a host machine and managed by a hypervisor. The intermediary guest manager manages one or more guest operating systems operating within the virtual machine and implements one or more security services for the guest operating systems. The security services provided to the guest operating systems may include system call filtering, memory protections, secure memory dumps, and others. In some cases, the intermediary guest manager consults a threat defense policy which contains a number of records, where each record has one or more triggers representing suspicious activity and one or more actions to take in response to being triggered. When the intermediary guest manager identifies a request, such as a system call or memory access, that meets the trigger of a particular record, the intermediary guest manager executes the associated actions to remediate the suspicious activity.

Claims20

Dependent claims

A method comprising:

receiving, via a virtual machine on a computer, a particular request from a guest operating system on the virtual machine, wherein the virtual machine intercepts one or more requests made by the guest operating system and then effectuates the one or more requests by invoking a hypervisor;
in response to receiving the particular request, determining whether the particular request meets a particular threat response trigger of a plurality of threat response triggers defined within a threat defense policy, wherein each threat response trigger of the plurality of threat response triggers defined within the threat defense policy has a corresponding remedial action;
in response to determining that the particular request meets the particular threat response trigger, performing the corresponding remedial action of the particular threat response trigger;
in response to determining that the particular request meets none of the plurality of threat response triggers, invoking the hypervisor to effectuate the particular request.

1 more element

A non-transitory computer-readable storage medium storing one or more instructions which, when executed by one or more processors, cause the one or more processors to perform steps comprising:

receiving, via a virtual machine on a computer, a particular request from a guest operating system on the virtual machine, wherein the virtual machine intercepts one or more requests made by the guest operating system and then effectuates the one or more requests by invoking a hypervisor;
in response to receiving the particular request, determining whether the particular request meets a particular threat response trigger of a plurality of threat response triggers defined within a threat defense policy, wherein each threat response trigger of the plurality of threat response triggers defined within the threat defense policy has a corresponding remedial action;
in response to determining that the particular request meets the particular threat response trigger, performing the corresponding remedial action of the particular threat response trigger;
in response to determining that the particular request meets none of the plurality of threat response triggers, invoking the hypervisor to effectuate the particular request.

1 more element

Dependencies are inferred from the claim text.

Threat defense techniques

Life of this patent

Threat defense techniques

Life of this patent

Abstract

Claims20