University of Washington

Vmware, Inc.

Alexander Moshchuk

Henry M Levy

Steven Gribble

Tanya Bragin

Ganesh Venkitachalam

A system analyzes content accessed at a network site to determine whether it is malicious. The system employs a tool able to identify spyware that is piggy-backed on executable files (such as software downloads) and is able to detect 'drive-by download' attacks that install software on the victim's computer when a page is rendered by a browser program. The tool uses a virtual machine (VM) to sandbox and analyze potentially malicious content. By installing and running executable files within a clean VM environment, commercial anti-spyware tools can be employed to determine whether a specific executable contains piggy-backed spyware. By visiting a Web page with an unmodified browser inside a clean VM environment, predefined 'triggers,' such as the installation of a new library, or the creation of a new process, can be used to determine whether the page mounts a drive-by download attack.

Detection of spyware threats within virtual machines

Detection of spyware threats within virtual machine

Method and systems for real-time cloning of a virtual machine are described. A virtual machine is running and a clone of the virtual machine is created while the virtual machine continues to run. In one embodiment, the creation of the clone further comprises quiesceing the virtual machine, taking a snapshot S(excluding main memory) of the state of the virtual machine, and creating a copy Sof the snapshot S. The original VM continues execution off the snapshot S. The cloned VM restores from snapshot S. In another embodiment, the cloning of the virtual machine further comprises instructing a vmkernel associated with the virtual machine to mark all pages of main memory of the virtual machine as copy-on-write (COW). The unique ID corresponding to the main memory is provided by the vmkernel and an association between the unique ID and the main memory is made upon restoration of the clone.

Real time cloning of a virtual machine

Growing community of inventors

Seattle, WA, United States of America

Alexander Moshchuk