Detection of malicious direct memory access device used for direct device assignment
Detection of malicious direct memory access (DMA) device used for direct device assignment. A virtualization computer system assigns a peripheral device to an operating context within a virtualization environment. The peripheral device is DMA capable. The virtualization computer system monitors a signal source that is affected by DMA operations initiated by the peripheral device while the peripheral device is assigned to the operating context. Based on monitoring the signal source, the virtualization computer system identifies a signal pattern characterizing the DMA operations that are initiated by the peripheral device. Using the signal pattern, the virtualization computer system determines that the DMA operations initiated by the peripheral device are abnormal and the virtualization computer system identifies the peripheral device as malicious.
1 . A method implemented in a computer system that includes a processor system, comprising:
re-assigning a peripheral device from a first guest partition within a virtualization environment to a host-controlled operating context within the virtualization environment, wherein the peripheral device is direct memory access (DMA) capable;
monitoring a signal source that is affected by DMA operations initiated by the peripheral device while the peripheral device is assigned to the host-controlled operating context, wherein the signal source is an input/output memory management unit (IOMMU);
based on monitoring the signal source, identifying a signal pattern characterizing the DMA operations that are initiated by the peripheral device, the signal pattern characterizing at least one of a frequency of memory accesses by the peripheral device, an amount of data being transferred by the peripheral device, or a set of memory locations targeted by the peripheral device;
determining, using the signal pattern, that the DMA operations initiated by the peripheral device are abnormal;
identifying the peripheral device as malicious based on the DMA operations initiated by the peripheral device being abnormal; and
based on identifying the peripheral device as malicious, preventing assignment of the peripheral device to a second guest partition within the virtualization environment.
2 . The method of claim 1 , wherein the peripheral device adheres to a bus connectivity standard.
3 . The method of claim 1 , wherein the peripheral device is one of a hardware accelerator or a hardware controller.
4 . The method of claim 1 , wherein,
the method further comprises:
enabling DMA remapping; and
creating a page table restricting memory pages that are accessible by the peripheral device; and
the signal pattern includes a page fault.
5 . The method of claim 1 , wherein the signal pattern includes the set of memory locations targeted by the peripheral device.
6 . The method of claim 5 , wherein the signal pattern includes a frequency of accesses to different memory pages in the set of memory locations.
7 . The method of claim 1 , wherein the signal source includes a performance monitoring unit (PMU).
8 . The method of claim 7 , wherein the signal pattern includes at least one of,
a number of address translations performed by the IOMMU on behalf of the peripheral device,
amount of data being transferred via DMA by the peripheral device,
a ratio of successful address translations per a unit of data transferred via DMA by the peripheral device; or
a hit rate or a miss rate in a translation lookaside buffer for address translations triggered by the peripheral device.
9 . The method of claim 1 , wherein,
the first guest partition is a guest virtual machine (VM) or a guest container; and
the host-controlled operating context is a root partition, host operating system, or a probationary VM.
10 . The method of claim 1 , wherein identifying the peripheral device as malicious comprises inputting the signal pattern to an artificial intelligence model.
11 . The method of claim 10 , wherein the artificial intelligence model is a machine learning model trained on signal patterns identified from an other peripheral device.
12 . The method of claim 11 , wherein the other peripheral device and the peripheral device share at least one of,
a device type,
a device manufacturer,
a device model,
a firmware build, or
a workload.
13 . A virtualization computer system, comprising:
a processor system comprising an input/output memory management unit (IOMMU); and
a computer storage medium that stores computer-executable instructions that are executable by the processor system to at least:
re-assign a peripheral device from a first guest partition at the virtualization computer system to a host-controlled operating context at the virtualization computer system, wherein the peripheral device is direct memory access (DMA) capable;
monitor an IOMMU signal source while the peripheral device is assigned to the host-controlled operating context;
based on monitoring the IOMMU signal source, identify a signal pattern characterizing DMA operations that are initiated by the peripheral device, the signal pattern characterizing at least one of a frequency of memory accesses by the peripheral device, an amount of data being transferred by the peripheral device, or a set of memory locations targeted by the peripheral device;
determine, using the signal pattern, that the DMA operations initiated by the peripheral device are abnormal;
identify the peripheral device as malicious based on the DMA operations initiated by the peripheral device being abnormal; and
based on identifying the peripheral device as malicious, preventing assignment of the peripheral device to a second guest partition at the virtualization computer system.
14 . The virtualization computer system of claim 13 , wherein,
the computer-executable instructions are also executable by the processor system to,
enable DMA remapping; and
create a page table restricting memory pages that are accessible by the peripheral device;
and
the signal pattern includes page fault.
15 . The virtualization computer system of claim 13 , wherein the signal pattern includes a set of memory pages accessed by the peripheral device, including a frequency of accesses to different memory pages in the set of memory pages.
16 . The virtualization computer system of claim 13 , wherein the IOMMU signal source includes a performance monitoring unit (PMU) metric, and wherein the signal pattern includes at least one of,
a number of address translations performed by the IOMMU on behalf of the peripheral device,
amount of data being transferred via DMA by the peripheral device,
a ratio of successful address translations per a unit of data transferred via DMA by the peripheral device; or
a hit rate or a miss rate in a translation lookaside buffer for address translations triggered by the peripheral device.
17 . A computer storage medium that stores computer-executable instructions that are executable by a processor system that includes an input/output memory management unit (IOMMU) to at least:
reassign a peripheral device from a first operating context within a virtualization environment to a second operating context within the virtualization environment, wherein,
the peripheral device is direct memory access (DMA) capable;
the first operating context comprises a guest virtual machine (VM); and
the second operating context comprises a root partition or a probationary VM;
monitor an IOMMU signal source while the peripheral device is assigned to the second operating context;
based on monitoring the IOMMU signal source, identify a signal pattern characterizing DMA operations that are initiated by the peripheral device, the signal pattern characterizing at least one of a frequency of memory accesses by the peripheral device, an amount of data being transferred by the peripheral device, or a set of memory locations targeted by the peripheral device;
determine, using the signal pattern and an artificial intelligence or machine learning model, that the DMA operations initiated by the peripheral device are abnormal;
identify the peripheral device as malicious based on the DMA operations initiated by the peripheral device being abnormal; and
based on identifying the peripheral device as malicious, prevent assignment of the peripheral device to a third operating context within the virtualization environment.
18 . The computer storage medium of claim 17 , wherein,
the IOMMU signal source includes a performance monitoring unit (PMU) metric, and
the signal pattern includes at least one of,
a number of address translations performed by the IOMMU on behalf of the peripheral device,
amount of data being transferred via DMA by the peripheral device,
a ratio of successful address translations per a unit of data transferred via DMA by the peripheral device; or
a hit rate or a miss rate in a translation lookaside buffer for address translations triggered by the peripheral device.