Defensive techniques to increase computer security
View Patent ↗Among other disclosed subject matter, a computer-implemented method includes executing a virtual machine on a physical machine, wherein the virtual machine comprises a hardware virtualization of a data processing apparatus. Access to a clock is monitored, wherein the clock is associated with the physical machine. A determination is made that the virtual machine is executing a malicious process based on the count. Access to the clock is limited by the virtual machine based on the determination that the virtual machine is executing a malicious process.
1. A computer-implemented method comprising:
executing a plurality of virtual machines on a physical machine, wherein each virtual machine comprises a hardware virtualization of a data processing apparatus;
monitoring read access of a clock by a first one of the virtual machines, wherein the clock is associated with the physical machine;
determining, based on the monitored read access of the clock, a rate of clock read accesses by the first virtual machine;
determining that the first virtual machine is executing a malicious process based on a determination that the rate of clock read accesses by the virtual machine is greater than a predefined threshold rate of read access;
limiting read access to the clock by the first virtual machine based at least in part on the determination that the first virtual machine is executing the malicious process; and
migrating a second one of virtual machines to a different physical machine in response to the determining.
2. The method of claim 1 wherein limiting read access to the clock comprises limiting a frequency of clock accesses by the virtual machine.
3. The method of claim 1 wherein limiting read access to the clock comprises reducing the accuracy of clock values that are provided in response to clock accesses.
4. The method of claim 1 wherein limiting read access to the clock comprises suspending or terminating the malicious process.
5. The method of claim 1 wherein the clock comprises a clock associated with a central processing unit associated with the physical machine.
6. The method of claim 5 wherein the clock associated with the central processing unit includes a time-stamp counter, a time of day clock, a power management timer or a high precision event timer.
7. The method of claim 1 wherein limiting read access to the clock is performed by a hypervisor.
8. The method of claim 1 wherein monitoring read accesses to the clock comprises accessing a hardware counter associated with the clock, wherein the hardware counter is associated with a central processing unit associated with the physical machine.
9. The method of claim 1 , wherein migrating a second one of virtual machines to a different physical machine in response to the determining comprises migrating the second one of the virtual machines only if any one of the virtual machines hosted on the physical machine is executing an encryption algorithm.
10. The method of claim 1 , further comprising profiling a plurality of virtual machines on a physical machine to determine the predefined threshold rate of read access.
11. A system comprising:
a data processing apparatus comprising a programmable computer included a memory storing instructions executable by the programmable computer and that configure the programmable computer to perform operations comprising:
executing a plurality of virtual machines on a physical machine, wherein each virtual machine comprises a hardware virtualization of a data processing apparatus;
monitoring read access of a clock by a first one of the virtual machines, wherein the clock is associated with the physical machine;
determining, based on the monitored read access of the clock, a rate of clock read accesses by the first virtual machine;
determining that the first virtual machine is executing a malicious process based on a determination that the rate of clock read accesses by the virtual machine is greater than a predefined threshold rate of read access;
limiting read access to the clock by the first virtual machine based at least in part on the determination that the first virtual machine is executing the malicious process; and
migrating a second one of virtual machines to a different physical machine in response to the determining.
12. The system of claim 11 wherein limiting read access to the clock comprises limiting a frequency of clock accesses by the virtual machine.
13. The system of claim 11 wherein limiting read access to the clock comprises reducing the accuracy of clock values that are provided in response to clock accesses.
14. The system of claim 11 wherein limiting read access to the clock comprises suspending or terminating the malicious process.
15. The system of claim 11 wherein the clock comprises a clock associated with a central processing unit associated with the physical machine.
16. The system of claim 15 wherein the clock associated with the central processing unit includes a time-stamp counter, a time of day clock, a power management timer or a high precision event timer.
17. The system of claim 11 wherein limiting read to the clock is performed by a hypervisor.
18. The system of claim 11 wherein monitoring read accesses to the clock comprises accessing a hardware counter associated with the clock, wherein the hardware counter is associated with a central processing unit associated with the physical machine.
19. The system of claim 11 , wherein migrating a second one of virtual machines to a different physical machine in response to the determining comprises migrating the second one of the virtual machines only if any one of the virtual machines hosted on the physical machine is executing an encryption algorithm.
20. The system of claim 11 , further comprising profiling a plurality of virtual machines on a physical machine to determine the predefined threshold rate of read access.
21. A non-transitory computer storage medium having instructions stored thereon that, when executed by a data processing apparatus, cause the data processing apparatus to perform operations comprising:
executing a plurality of virtual machines on a physical machine, wherein each virtual machine comprises a hardware virtualization of a data processing apparatus;
monitoring read access of a clock by a first one of the virtual machines, wherein the clock is associated with the physical machine;
determining, based on the monitored read access of the clock, a rate of clock read accesses by the first virtual machine;
determining that the first virtual machine is executing a malicious process based on a determination that the rate of clock read accesses by the virtual machine is greater than a predefined threshold rate of read access;
limiting read access to the clock by the first virtual machine based at least in part on the determination that the first virtual machine is executing the malicious process; and
migrating a second one of virtual machines to a different physical machine in response to the determining.
22. The non-transitory computer storage medium of claim 21 wherein limiting read access to the clock comprises limiting a frequency of clock accesses by the virtual machine.
23. The non-transitory computer storage medium of claim 21 wherein limiting read access to the clock comprises reducing the accuracy of clock values that are provided in response to clock accesses.
24. The non-transitory computer storage medium of claim 21 wherein limiting read access to the clock comprises suspending or terminating the malicious process.
25. The non-transitory computer storage medium of claim 21 wherein the clock comprises a clock associated with a central processing unit associated with the physical machine.
26. The non-transitory computer storage medium of claim 25 wherein the clock associated with the central processing unit includes a time-stamp counter, a time of day clock, a power management timer or a high precision event timer.
27. The non-transitory computer storage medium of claim 21 wherein limiting read access to the clock is performed by a hypervisor.
28. The non-transitory computer storage medium of claim 21 wherein monitoring read accesses to the clock comprises accessing a hardware counter associated with the clock, wherein the hardware counter is associated with a central processing unit associated with the physical machine.