George Mason Research Foundation, Inc.

George Mason Intellectual Properties, Inc.

Yih Huang

Anup K Ghosh

Jiang Wang

Sushil Jajodia

Angelos Stavrou

Arun Sood

David Arsenault

Processor(s) for detecting malicious software. A hardware virtual machine monitor (HVMM) operates under a host OS. Container(s) initialized with network application template(s) operate under a guest OS VM. A detection module operates under the guest OS VM includes a trigger detection module, a logging module and a container command module. The trigger detection module monitors activity on container(s) for a trigger event. The logging module writes activity report(s) in response to trigger event(s). The container command module issues command(s) in response to trigger event(s). The command(s) include a container start, stop and revert commands. A virtual machine control console operates under the host OS and starts/stops the HVMM. A container control module operates under the guest OSVM and controls container(s) in response to the command(s). The server communication module sends activity report(s) to a central collection network appliance that maintains a repository of activities for infected devices.

Methods and apparatus for application isolation

An on-demand disposable virtual work system that includes: a virtual machine monitor to host virtual machines, a virtual machine pool manager, a host operating system, a host program permissions list, and a request handler module. The virtual machine pool manager manages virtual machine resources. The host operating system interfaces with a user and virtual machines created with an image of a reference operating system. The host program permissions list may be a black list and/or a white list used to indicate allowable programs. The request handler module allows execution of the program if the program is allowable. If the program is not allowable, the host request handler module: denies program execution and urges a virtual machine specified by the virtual machine pool manager to execute the program. The virtual machine is terminated when the program closes.

On-demand disposable virtual work system

An embodiment for providing a secure virtual browsing environment includes creating a virtual browsing environment with a virtualized operating system sharing an operating system kernel of a supporting operating system and executing the browser application within the virtual browsing environment. Another embodiment includes receiving a website selection within a browser application, determining if the website selection corresponds to a secure bookmark, and creating a second virtual browsing environment and executing the browser application within the second virtual browsing environment to access the website selection when the website selection corresponds to a website specified as a secure bookmark. Yet another embodiment includes monitoring operation of the operating system within the at least one virtual browsing environment, determining when the operation of the operating system includes potential malicious activity, and terminating the virtual browsing environment when the operation includes potential malicious activity.

Virtual browsing environment

Processor(s) for detecting malicious software. A hardware virtual machine monitor (HVMM) operates under a host OS. Container(s) initialized with network application template(s) operate under a guest OS VM. A detection module operates under the guest OS VM includes a trigger detection module, a logging module and a container command module. The trigger detection module monitors activity on container(s) for a trigger event. The logging module writes activity report(s) in response to trigger event(s). The container command module issues command(s) in response to trigger event(s). The command(s) include a container start, stop and revert commands. A virtual machine control console operates under the host OS and starts/stops the HVMM. A container control module operates under the guest OS VM and controls container(s) in response to the command(s). The server communication module sends activity report(s) to a central collection network appliance that maintains a repository of activities for infected devices.

An attack resistant continuous network service trustworthiness controller comprising: state estimation module(s), response selection module(s), actuation module(s), and client dispatcher communication module(s) for maintaining the availability and integrity of online server(s). The state estimation module(s) are configured to generate state estimate(s) for online server(s) using behavior data obtained using sensor module(s). The response selection module(s) are configured to determine corrective action(s) to maintain the availability and integrity of online server(s) when state estimate(s) indicate that the integrity of an online server(s) is compromised. The actuation module(s) are configured to activate actuator(s) based upon the corrective action(s). Client dispatcher communication module(s) are configured to communicate online server availability information to a client dispatcher.

Attack resistant continuous network service trustworthiness controller

A method, system and computer program product for controlling a processing unit connected to a network. The method includes providing information to the network by the processing unit via plural communication channels; sending a reset signal from a controller to a reset unit of the processing unit after a specified amount of time, the reset unit being connected only to a communication channel of the controller and being isolated from the plural communication channels; and rebooting the processor unit when the reset signal is received by the reset unit.

Data alteration prevention system

Disclosed is a self-cleansing intrusion tolerance-domain name systems system comprising at least three DNS servers, at least four storage systems accessible by the DNS servers, a communications link, a message transfer mechanism, and a self-cleansing mechanism. The storage systems include at least three online storage systems and at least one offline storage system. The communications link can connect the DNS servers with the storage systems, as well as connect the DNS servers with a local area network, which can connect the DNS servers with an external network. The message transfer mechanism can rotate the DNS servers into a plurality of roles, including a primary role, a secondary role, a designated role, and a self-cleansing role. The self-cleansing mechanism can be used to perform the self-cleansing role.

Growing community of inventors

Fairfax Station, VA, United States of America

Yih Huang