Evaluating malware in a virtual machine using dynamic patching
AssigneePalo Alto Networks, Inc.
InventorsXinran Wang, Huagang Xie
Life of this patent
Estimating the term…
Abstract
Analysis of potentially malicious software samples in a virtualized environment is disclosed. One or more modifications are applied to a first virtual machine instance. The first virtual machine instance is initialized as a copy-on-write overlay associated with an original virtual machine image. Further, at least one modification includes the installation of startup instructions. The modified virtual machine instance is stared. A first set of modifications resulting from executing the first virtual machine instance is captured.
Claims21
A system, comprising:
- a hardware processor configured to:
- initialize, as a copy-on-write overlay associated with an original virtual machine image, a first virtual machine instance, wherein the first virtual machine instance is an overlay of a hierarchy of virtual machine images, and wherein the original virtual machine image comprises the root of the hierarchy;
- apply a set of one or more modifications to the first virtual machine instance;
- start the modified virtual machine instance;
- capture a first set of data resulting from executing a first sample in the modified virtual machine instance;
- and
- determine, based at least in part on an analysis of the captured data that the first sample is malicious;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- initializing, as a copy-on-write overlay associated with an original virtual machine image, a first virtual machine instance, wherein the first virtual machine instance is an overlay of a hierarchy of virtual machine images, and wherein the original virtual machine image comprises the root of the hierarchy;
- applying a set of one or more modifications to the first virtual machine instance;
- starting the modified virtual machine instance;
- capturing a first set of data resulting from executing a first sample in the modified virtual machine instance;
- and
- determining, based at least in part on an analysis of the captured data that the first sample is malicious.
A computer program product embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:
- initializing, as a copy-on-write overlay associated with an original virtual machine image, a first virtual machine instance, wherein the first virtual machine instance is an overlay of a hierarchy of virtual machine images, and wherein the original virtual machine image comprises the root of the hierarchy;
- applying a set of one or more modifications to the first virtual machine instance;
- starting the modified virtual machine instance;
- capturing a first set of data resulting from executing a first sample in the modified virtual machine instance;
- and
- determining, based at least in part on an analysis of the captured data that the first sample is malicious.
Dependencies are inferred from the claim text.