US 8,079,030 B1 · Detecting stealth network communications

Abstract

A computer has a hypervisor that supervises a virtual machine. The virtual machine includes a guest security module that enforces a security policy on network traffic entering and exiting the virtual machine. Malicious software (malware) uses stealth network communications to avoid the guest security module and attempts to communicate with its home base. A security module within the hypervisor has access to all network communications entering and exiting the computer. The security module communicates with the guest security module to identify communications of which the guest security module is aware. The security module analyzes the network communications for the computer to identify a stealth network communication of which the guest security module is unaware. The security module alters the stealth network communication, thereby prevent the malware from communicating with its home base.

Claims15

Dependent claims

A method of detecting stealth network communications in a computer having a hypervisor supervising a virtual machine, the virtual machine having a virtualized network interface, the method comprising:

establishing a secure communications channel between a guest security module executing within the virtual machine and a security module executing within the hypervisor;
communicating, by the security module executing within the hypervisor using the secure communications channel, with the guest security module executing within the virtual machine to identify real-time network communications on the virtualized network interface of the virtual machine detected by the guest security module;
maintaining, by the security module executing within the hypervisor, a list of the identified real-time network communications on the virtualized network interface of the virtual machine detected by the guest security module;
identifying, by the security module executing within the hypervisor, real-time network communications involving the computer;
identifying, by the security module executing within the hypervisor, a stealth network communication on the virtualized network interface of the virtual machine undetected by the guest security module by correlating the identified real-time network communications involving the computer with the list of identified real-time network communications on the virtualized network interface of the virtual machine detected by the guest security module;
and
altering the stealth network communication.

4 more elements

A system for detecting stealth network communications in a computer having a hypervisor supervising a virtual machine, the virtual machine having a virtualized network interface, the system comprising:

a non-transitory computer-readable storage medium storing executable computer program modules comprising:
a security module for executing within the hypervisor and comprising:
a communications module for:
establishing a secure communication channel to a guest security module executing within the virtual machine;
and
communicating using the secure communication channel with the guest security module executing within the virtual machine to identify real-time network communications on the virtualized network interface of the virtual machine detected by the guest security module;
a security policy cache for maintaining a list of the identified real-time network communications on the virtualized network interface of the virtual machine detected by the guest security module;
an analysis module for identifying real-time network communications involving the computer;
a verification module for identifying a stealth network communication on the virtualized network interface of the virtual machine undetected by the guest security module by correlating the identified real-time network communications involving the computer with the list of identified real-time network communications on the virtualized network interface of the virtual machine detected by the guest security module;
and
an alteration module for altering the stealth network communication;
and
a processor for executing the executable computer program modules.

10 more elements

A computer program product having a non-transitory computer-readable storage medium having executable computer program instructions embodied therein for detecting stealth network communications in a computer having a hypervisor supervising a virtual machine, the virtual machine having a virtualized network interface, the computer program product comprising:

a security module for executing within the hypervisor and comprising:
a communications module for:
establishing a secure communication channel to a guest security module executing within the virtual machine;
and
communicating using the secure communication channel with the guest security module executing within the virtual machine to identify real-time network communications on the virtualized network interface of the virtual machine detected by the guest security module;
a security policy cache for maintaining a list of the identified real-time network communications on the virtualized network interface of the virtual machine detected by the guest security module;
an analysis module for identifying real-time network communications involving the computer;
a verification module for identifying a stealth network communication on the virtualized network interface of the virtual machine undetected by the guest security module by correlating the identified real-time network communications involving the computer with the list of identified real-time network communication on the virtualized network interface of the virtual machine detected by the guest security module;
and
an alteration module for altering the stealth network communication.

7 more elements

Dependencies are inferred from the claim text.

Detecting stealth network communications

Life of this patent

Detecting stealth network communications

Life of this patent

Abstract

Claims15