System, method and computer program product for detecting unwanted effects utilizing a virtual machine
View Patent ↗A security system, method and computer program product are provided. In use, a request destined to a target computer is received, utilizing a virtual machine. The request is processed to identify an unwanted effect associated therewith, utilizing the virtual machine. In addition, the target computer is allowed access to the request, based on the processing.
1. A method to detect unwanted effects from the performance of a requested act, comprising:
intercepting, by a first computer providing a virtual machine environment, a first request to perform an act at a target computer, the first computer comprising a hardware processor;
performing the requested act within the virtual machine environment;
monitoring the performed act to identify an effect;
intercepting, by the first computer, one or more additional requests to perform a second act at a second target computer;
performing the one or more additional requested acts within the virtual machine environment;
identifying an unwanted effect based on performing the one or more additional requests to perform the second act within the virtual machine environment;
attempting to identify a specific request from the one or more additional requests that resulted in the unwanted effect by associating a timing of the specific request and the identified unwanted based upon known correlations between request types and unwanted effects;
identifying a time period between a last clean state of the virtual machine environment and the unwanted effect when the specific request that resulted in the unwanted effect cannot be identified;
blocking all requests of the one or more additional requests intercepted during the identified time period; and
forwarding the first request to perform the act to the target computer when the identified effect is not an unwanted effect.
2. The method of claim 1 , wherein the first computer comprises an intermediate computer that is networked between the target computer and a computer from which the request is received.
3. The method of claim 1 , wherein the first computer providing the virtual machine environment comprises the target computer.
4. The method of claim 1 , wherein only predetermined types of requests are intercepted.
5. The method of claim 1 , wherein requests of a type predetermined to be unlikely to result in unwanted effects are automatically forwarded to the target computer.
6. The method of claim 1 , wherein the act of monitoring the performed act to identify an unwanted effect comprises utilizing at least one of signatures, heuristics, and behavioral intrusion prevention techniques.
7. The method of claim 1 , further comprising delaying forwarding the request to perform the act to the target computer for a certain time period to allow time to identify an unwanted effect.
8. The method of claim 7 , wherein the time period is dependent upon a type of the request.
9. The method of claim 1 , further comprising identifying a source of the specific request that resulted in the unwanted effect.
10. The method of claim 9 , further comprising blocking all requests originating from the source of the specific request.
11. The method of claim 1 , wherein the last clean state of the virtual machine is identified utilizing a snapshot of the virtual machine.
12. The method of claim 1 wherein the second target computer and the first target computer are different computers.
13. A non-transitory computer program storage device, comprising computer code for causing a processor associated with a first computer providing a virtual machine environment to:
intercept a first request to perform an act at a target computer;
perform the requested act within the virtual machine environment;
monitor the performed act to identify an effect;
intercept one or more additional requests to perform a second act at a second target computer;
perform the one or more additional requested acts within the virtual machine environment;
identify an unwanted effect based on performing the one or more additional requests to perform the second act within the virtual machine environment;
attempt to identify a specific request from the one or more additional requests that resulted in the unwanted effect by associating a timing of the specific request and the identified unwanted based upon known correlations between request types and unwanted effects;
identify a time period between a last clean state of the virtual machine environment and the unwanted effect when the specific request that resulted in the unwanted effect cannot be identified;
block all requests of the one or more additional requests intercepted during the identified time period; and
forward the first request to perform the act to the target computer when the identified effect is not an unwanted effect.
14. The non-transitory computer program storage device of claim 13 , wherein only predetermined types of requests are intercepted.
15. The non-transitory computer program storage device of claim 13 , wherein requests of a type predetermined to be unlikely to result in unwanted effects are automatically forwarded to the target computer.
16. The non-transitory computer program storage device of claim 13 , further comprising identifying a source of the specific request that resulted in the unwanted effect.
17. The non-transitory computer program storage device of claim 16 , further comprising blocking all requests originating from the source of the specific request.
18. The non-transitory computer program storage device of claim 13 , wherein the last clean state of the virtual machine is identified utilizing a snapshot of the virtual machine.
19. The non-transitory computer program storage device of claim 13 , wherein the second target computer and the first target computer are different computers.
20. A system, comprising:
a memory;
a virtual machine environment; and
a hardware processor operatively coupled to the memory, the hardware processor adapted to execute program code stored in the memory to:
intercept a first request to perform an act at a target computer;
perform the requested act within the virtual machine environment;
monitor the performed act to identify an effect;
intercept one or more additional requests to perform a second act at a second target computer;
perform the one or more additional requested acts within the virtual machine environment;
identify an unwanted effect based on performing the one or more additional requests to perform the second act within the virtual machine environment;
attempt to identify a specific request from the one or more additional requests that resulted in the unwanted effect by associating a timing of the specific request and the identified unwanted based upon known correlations between request types and unwanted effects;
identify a time period between a last clean state of the virtual machine environment and the unwanted effect when the specific request that resulted in the unwanted effect cannot be identified;
block all requests of the one or more additional requests intercepted during the identified time period; and
forward the first request to perform the act to the target computer when the identified act is not an unwanted effect.