Nicira, Inc.

Vmware, Inc.

Prasad Sharad Dabak

Amit Vasant Patil

W Andrew Lambeth

Justin Pettit

Vasantha Kumar Dhanasekar

Azeem Feroz

Laxmikant Vithal Gunda

Leena Shuklendu Soman

Vasantha Kumar

Goresh Musalay

Alok Nemchand Kataria

Gaurav Sharma

Binyuan Chen

Achindra Bhatnagar

Some embodiments provide a system that detects whether a data flow is an elephant flow; and if so, the system treats it differently than a mouse flow. The system of some embodiments detects an elephant flow by examining, among other items, the operations of a machine. In detecting, the system identifies an initiation of a new data flow associated with the machine. The new data flow can be an outbound data flow or an inbound data flow. The system then determines, based on the amount of data being sent or received, if the data flow is an elephant flow. The system of some embodiments identifies the initiation of a new data flow by intercepting a socket call or request to transfer a file.

Inspecting operations of a machine to detect elephant flows

Example methods are provided to use a guest monitoring mode (GMM) module in a hypervisor to authenticate hypercalls sent by a guest agent to the GMM module. The GMM module uses reference information, including thread information associated with a thread, to determine whether a hypercall associated with the thread was issued by the trusted guest agent or by potentially malicious code.

Hypercall authentication in a guest-assisted virtual machine introspection (VMI) implementation

Example methods are provided to use a guest monitoring mode (GMM) module in a hypervisor to monitor for attempts to maliciously modify operating system (OS) kernel objects in a virtualized computing environment. A created OS kernel object is migrated to a memory space where the GMM module can detect an attempt to modify the OS kernel object. The GMM module uses reference information to determine whether the modification is authorized by trusted OS kernel code or is being attempted by malicious code.

Protecting operating system kernel objects using a hypervisor

Example methods are provided for virtual machine introspection in which a guest monitoring mode (GMM) module monitors the execution of guest calls by an agent that resides in a virtual machine (VM). The GMM module sets a bit in bit mask that corresponds to a guest call that the agent needs to execute, and inserts an invisible breakpoint in the code of the guest call. If the GMM module detects that despite the setting of the bit in the bit mask, the agent does not complete the execution of the code (due to the invisible breakpoint not being triggered), then the GMM module considers this condition as a potential hijack of the VM by malicious code.

Implementing deferred guest calls in a host-based virtual machine introspection system

A method is provided for a hypervisor to dynamically discover internal address information of a guest kernel on a virtual machine. The method includes locating a kernel exported system call or function in an image of the guest kernel in guest memory of the virtual machine, disassembling machine code of the kernel exported system call or function in the image into assembly code, detecting a pattern from memory references in the assembly code, and, after detecting the pattern, determining the internal address information of the guest kernel from the assembly code.

Dynamic discovery of internal kernel functions and global data

Some embodiments provide a novel method for authorizing network requests for a machine in a network. In some embodiments, the method is performed by security agents that execute on virtual machines operating on a host machine. In some embodiments, the method captures a network request (e.g., network control packets, socket connection request, etc.) from a primary application executing on the machine. The method identifies an extended context for the network request and determines whether the network request is authorized based on the extended context. The method then processes the network request according to the determination. The extended context of some embodiments includes identifications for primary and secondary applications associated with the network request. Alternatively, or conjunctively, some embodiments include identifications for primary and secondary users associated with the network request.

Extended context delivery for context-based authorization

A method is provided for a kernel driver in an operating system to detect loading of images into memory and unloading of the images from memory. The method includes registering a callback routine for load-image notifications, receiving a load-image notification for an image and recording loading of the image, storing original code at or about an entry point of the image, and patching redirect stub code over the original code at or about the entry point. The method also includes receiving, from the redirect stub code, a redirected call to or about the entry point to execute a routine in the image. The redirected call identifies a driver object representing the image. The method further includes, based on the driver object, providing a mechanism to intercept unloading of the image and recording the unloading of the image.

Tracking driver load and unload on windows OS

The subject matter described herein provides protection against zero-day attacks by detecting, via a hypervisor maintaining an extended page table, an attempt to execute arbitrary code associated with malware in a guest operation system (OS) running within a virtual machine (VM). Further, the subject matter provides detection of lateral movement of the malware. The hypervisor uses hidden breakpoints to detect a request for thread creation, and then determines whether the request is to download and execute arbitrary code.

Detecting lateral movement using a hypervisor

Detecting arbitrary code execution using a hypervisor

An example method of managing guest code in a virtualized computing instance of a virtualized computing system includes: receiving, at a hypervisor that manages the virtualized computing instance, identifiers for a first guest-physical memory page, which stores a patched version of the guest code, and a second guest-physical memory page, which stores an original version of the guest code; modifying an entry in a nested page table (NPT), which is associated with the first guest-physical memory page, to cause an exception to the hypervisor in response to a first read operation, performed by first software in the virtualized computing instance, which targets the first guest-physical memory page; and executing, at the hypervisor in response to the exception, a second read operation that emulates the first read operation, but targets the second guest-physical memory page.

Transparent code patching using a hypervisor

A hypervisor monitors for an initialization of a guest kernel running on a virtual machine implemented by the hypervisor. When the initialization of the guest kernel is detected, the hypervisor pauses a virtual processor of the virtual machine, locates a guest kernel image of the guest kernel in guest memory, locates a kernel function in the guest kernel image, inserts a breakpoint on the guest kernel function, resumes the virtual processor and monitors for a breakpoint instruction. After detecting the breakpoint instruction, the hypervisor gathers guest context by examining the guest memory and guest registers, pauses the virtual processor, constructs and injects a code gadget configured to run in the virtual machine, diverts the virtual processor to execute the code gadget, which causes the virtual processor to call the hypervisor at the end of executing the code gadget, and returns the virtual processor to execute the guest kernel function.

Host-based virtual machine introspection with dynamic guest assistance

Example methods are provided for locating an operating system (OS) data structure on a host according to a hypervisor-assisted approach. The method may comprise a virtualized computing instance identifying a guest virtual memory address range in which the OS data structure is stored; and configuring the hypervisor to perform a safe read on the guest virtual memory address range to access data stored within the guest virtual memory address range. The method may further comprise the virtualized computing instance performing attribute matching by comparing the data stored within the guest virtual memory address range with attribute data associated with the OS data structure; and determining a location associated with the OS data structure based on the attribute matching.

Growing community of inventors

Pune, India

Prasad Sharad Dabak