# US 8,782,809 B2 · Limiting information leakage and piracy due to virtual machine cloning

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,782,809 B2
- Document ID: US8782809B2
- Status: Granted
- Kind: B2
- Application number: 13/673,358
- Filed: 2012-11-09
- Published: 2014-05-15
- Granted: 2014-07-15
- Earliest claimed: 2012-11-09
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Salman A. Baset; Ashish Kundu; Sambit Sahu
- Web page: https://patentgrep.com/patent/US8782809B2

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/554: {involving event detection and direct action}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Techniques for detecting a cloned virtual machine instance. A method includes transmitting an identifier associated a virtual machine from an agent embedded in the virtual machine akin to a malware to a detection entity in a network, determining whether the identifier is a unique identifier or whether the identifier is a clone of an identifier associated with a separate virtual machine in the network, and initiating at least one remedial action with the agent embedded in the virtual machine if the identifier is determined to be a clone of an identifier associated with a separate virtual machine in the network.

## Claims

### Claim 1

A method for detecting a cloned virtual machine instance, the method comprising:
generating a unique identifier for each virtual machine in a network;
transmitting an identifier associated with a given virtual machine from an agent embedded in the virtual machine akin to a malware to a detection entity in the network;
determining whether the identifier is one of the generated unique identifiers or whether the identifier is a clone of an identifier associated with a separate virtual machine in the network; and
initiating at least one remedial action with the agent embedded in the virtual machine if the identifier is determined to be a clone of an identifier associated with a separate virtual machine in the network;
wherein at least one of said generating, said transmitting, said determining and said initiating is carried out by a computer device.

### Claim 2 (depends on 1)

The method of claim 1, wherein said transmitting comprises transmitting at a random frequency.

### Claim 3 (depends on 1)

The method of claim 1, wherein said transmitting comprises transmitting at a pre-specified interval.

### Claim 4 (depends on 1)

The method of claim 1, wherein said transmitting comprises transmitting at a frequency that corresponds to mode of the agent.

### Claim 5 (depends on 1)

The method of claim 1, wherein said determining comprises utilizing an authenticated list of identifiers for comparison with the transmitted identifier.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
embedding an agent into each virtual machine in the network.

### Claim 7 (depends on 1)

The method of claim 1, wherein the agent utilizes at least one malware technique, wherein said at least one malware technique comprises at least one of dynamic-link library linkage, random invocation upon a system, and/or a program call invocation.

### Claim 8 (depends on 1)

The method of claim 1, wherein the detection entity comprises a central server.

### Claim 9 (depends on 1)

The method of claim 1, wherein the detection entity comprises one or more detecting peer virtual machines in a peer-to-peer network.

### Claim 10 (depends on 1)

The method of claim 1, wherein the detection entity comprises one or more central servers and one or more peer-to-peer virtual machines.

### Claim 11 (depends on 1)

The method of claim 1, wherein the at least one remedial action comprises the agent blocking all network connections and implementing self-destruction of the virtual machine if the agent cannot reach the network within a pre-determined amount of time.

### Claim 12 (depends on 1)

The method of claim 1, wherein the at least one remedial action comprises self-destruction of by the agent by wiping out the virtual machine disk.

### Claim 13 (depends on 1)

The method of claim 1, wherein the at least one remedial action comprises automatic or manual shutdown of the virtual machine associated with the cloned identifier.

### Claim 14 (depends on 1)

The method of claim 1, wherein the at least one remedial action comprises providing a notification to a system administrator of a provider to block the virtual machine associated with the cloned identifier.

### Claim 15 (depends on 1)

The method of claim 1, wherein the at least one remedial action comprises providing a notification to a user to block the virtual machine associated with the cloned identifier.

### Claim 16 (depends on 1)

The method of claim 1, wherein the detection entity comprises a central server and a peer-to-peer network.