Emc IP Holding Company LLC

Maya Bakshi

Philip Derbeko

Assaf Natanzon

Uriya Stern

Yuri Manusov

Yaniv Harel

Anton Pavlinov

Shai Kappel

Moran Zahavy

A system, computer program product, and computer-executable method of detecting malware in a virtual machine (VM), the computer-executable method comprising periodically creating snapshots of the VM, analyzing each of the snapshots in comparison to one or more previous snapshots to determine whether anomalies exist, and based on a threshold amount of anomalies detected, scanning the VM to determine whether malware is detected.

Malware detection in virtual machines

A computer program product, system, and method for generating coded fragments comprises receiving a request to generate a memory snapshot for a virtual machine (VM), copying the VM's memory to generate a memory snapshot, obtaining information about cache structures within the memory snapshot, invalidating one or more of the cache structures and zeroing out corresponding cache data within the memory snapshot, and storing the memory snapshot to storage.

Compressing memory snapshots

A computer program product, system, and method for generating coded fragments comprises initializing historical I/O activity data structures and recent I/O activity data structures associated with a logical unit (LU) of storage; receiving an I/O request from a host, the I/O request associated with one or more chunks within the LU; adding metadata about the I/O request to the recent I/O activity data structures; generating a ransomware probability by comparing the recent I/O activity data structures to the historical I/O activity data structures; and if the ransomware probability exceeds a first threshold value, taking one or more first actions to mitigate the effects of ransomware within the host.

Ransomware detection using I/O patterns

Example embodiments relate to methods, systems, and a computer program product for detecting and responding to the presence of malware persistently executing in a monitored virtual machine of a virtual computing platform. The method includes logging I/O requests at a hypervisor kernel in a kernel log and at a virtual machine (VM) managed by the hypervisor in a VM log. The logged I/O requests then may be compared to detect evidence of malware according to differences between the I/O requests logged in the VM log and the kernel log.

Growing community of inventors

Beer Sheva, Israel

Maya Bakshi