US 9,871,812 B2Granted

Methods and apparatus for application isolation

AssigneeGeorge Mason Research Foundation, Inc.

InventorsAnup Ghosh, Yih Huang, Jiang Wang, Angelos Stavrou

Life of this patent

Estimating the term…

Loading patent…

Abstract

Processor(s) for detecting malicious software. A hardware virtual machine monitor (HVMM) operates under a host OS. Container(s) initialized with network application template(s) operate under a guest OS VM. A detection module operates under the guest OS VM includes a trigger detection module, a logging module and a container command module. The trigger detection module monitors activity on container(s) for a trigger event. The logging module writes activity report(s) in response to trigger event(s). The container command module issues command(s) in response to trigger event(s). The command(s) include a container start, stop and revert commands. A virtual machine control console operates under the host OS and starts/stops the HVMM. A container control module operates under the guest OS VM and controls container(s) in response to the command(s). The server communication module sends activity report(s) to a central collection network appliance that maintains a repository of activities for infected devices.

Claims20

Dependent claims

A system for detecting malicious software comprising:

a) at least one network application template, the at least one network application template including:
i) a modifiable section;
and
ii) a non-modifiable section;
b) an application processor comprising:
i) a virtual machine monitor to execute on a hardware computing machine under control of a host operating system;
ii) at least one container:
(1) to execute in a protected memory space under control of a guest operating system virtual machine;
(2) initialized with at least one copy of the at least one network application template;
and
(3) including:
(a) a file system;
and
(b) a network address;
iii) a detector to execute under control of the guest operating system virtual machine, the detector of the application processor to:
(1) monitor activity on the at least one container for a trigger event;
(2) write an indication of the activity to an activity report in response to the trigger event;
and
(3) conditionally issue at least one command in response to the trigger event, the at least one command being at least one of the following:
(a) a container stop command;
(b) a container revert command;
and
(c) a container start command;
iv) a virtual machine control console to:
(1) operate under control of the host operating system;
and
(2) start and stop the virtual machine monitor;
v) a container controller to:
(1) operate under control of the guest operating system virtual machine;
(2) start the at least one container in response to the container start command;
(3) stop the at least one container in response to the container stop command;
and
(4) revert the at least one container in response to the container revert command;
and
the application processor to transmit the activity report over a network to a central collection network appliance to store the indication of the activity from the activity report in a repository of activities for infected devices.

32 more elements

An apparatus for detecting malicious software comprising:

a) an appliance processor of a hardware computing machine;
b) a hardware virtual machine monitor to execute on the appliance processor of the hardware computing machine under control of a host operating system;
c) at least one network application template, the at least one network application template including:
i) a modifiable section;
and
ii) a non-modifiable section;
d) at least one container to execute on the appliance processor, the at least one container:
i) to operate in a protected memory space under control of a guest operating system virtual machine;
ii) initialized with at least one copy of the at least one network application template;
and
iii) including:
(1) a file system;
and
(2) a network address;
e) a detector to execute on the appliance processor, the detector to execute under control of the guest operating system virtual machine, the detector of the appliance processor to:
i) monitor activity on the at least one container for a trigger event;
ii) write an indication of the activity to an activity report in response to the trigger event;
and
iii) conditionally issue at least one command in response to the trigger event, the at least one command being at least one of the following:
(1) a container stop command;
(2) a container revert command;
and
(3) a container start command;
f) a virtual machine control console to execute on the appliance processor, the virtual machine control console to:
i) operate under control of the host operating system;
and
ii) start and stop the hardware virtual machine monitor;
g) a container controller to execute on the appliance processor, the container controller to:
i) operate under control of the guest operating system virtual machine;
ii) start the at least one container in response to the container start command;
iii) stop the at least one container in response to the container stop command;
and
iv) revert the at least one container in response to the container revert command;
and
the hardware computing machine to send the activity report to a central collection network appliance over a network to store the indication of the activity from the activity report in a repository of activities for infected devices.

32 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/459,563Filed 15 Mar 2017 · continuation
Priority: 12 Sep 2008
Published: US 2017/0302692 A119 Oct 2017
Granted: 16 Jan 2018
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
G06F 9/45545
Hypervisors; Virtual machine monitors: guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
G06F 21/53
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by executing in a restricted environment, e.g.…
G06F 21/55
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: detecting local…

Family

Application61/096,591Us provisional application · filed 12 Sep 2008
Application12/558,841Parent of this continuation · filed 14 Sep 2009
Application14/808,681Parent of this continuation · filed 24 Jul 2015
US 2017/0302692 A1Pre-grant publication · published 19 Oct 2017
US 9,602,524 B2Parent of this continuation
US 9,098,698 B2Parent of this continuation
US 2010/0122343 A1Published application
US 2016/0182540 A1Published application
US 9,871,812 B2This patent

From the US filing history. Foreign family members aren’t listed.