System, apparatus and method for using malware analysis results to drive adaptive instrumentation of virtual machines to improve exploit detection
View Patent ↗According to one embodiment, an electronic device comprises a memory to store information and a processor. The processor is adapted to receive information associated with content such as network traffic, to process the stored information and to conduct operations on the content. These operations may comprise determining, by a virtual machine processed by the processor, an occurrence of an event during malware analysis of an object associated with the content, and dynamically altering a virtual machine instrumentation of the virtual machine based on information associated with the event.
1. A computerized method comprising:
determining, by a virtual machine being executed by hardware circuitry, an event that has occurred during a malware analysis of an object and the malware analysis includes an analysis of characteristics associated with anomalous behavior of the object during execution of the object within the virtual machine, the virtual machine includes a guest virtual system and a host virtual system; and
dynamically altering at least a host kernel space of an instrumentation of the virtual machine by the hardware circuitry based on information associated with the event, the dynamic altering of the virtual machine instrumentation comprises changing an instrumentation of a virtual device of the virtual machine from a first instrumentation of the virtual device to a second instrumentation of the virtual device while preserving a state of the virtual device as perceived by the guest virtual system, wherein the second instrumentation of the virtual device being different from the first instrumentation of the virtual device,
wherein the event comprises a detected behavior that is associated with a particular exploit or a particular exploit type.
2. The computerized method of claim 1 , wherein the hardware circuitry comprises one or more processors.
3. The computerized method of claim 1 , wherein the second instrumentation of the virtual device being downloaded from a cloud computing service.
4. The computerized method of claim 1 , wherein the virtual machine instrumentation comprises logic that performs one of a plurality of virtualized operations including (i) controlling virtualized operations conducted on the object associated with content that includes network traffic and (ii) monitoring the virtualized operations conducted on the object.
5. The computerized method of claim 1 , wherein determining of the event during malware analysis of the object further comprises (i) performing a replay operation on the object and (ii) analyzing the characteristics associated with the anomalous behavior if an exploit associated with the object is detected during the replay operation.
6. The computerized method of claim 1 , wherein the characteristics associated with the anomalous behavior comprises at least one of unexpected network transmissions from an electronic device that comprises the hardware circuitry and unexpected changes in performance by the electronic device.
7. A computerized method comprising:
determining, by a virtual machine being executed by hardware circuitry, an event that has occurred during a malware analysis of an object and the malware analysis includes an analysis of characteristics associated with anomalous behavior of the object during execution of the object within the virtual machine, the virtual machine includes a guest virtual system and a host virtual system; and
dynamically altering at least the host virtual system of an instrumentation of the virtual machine by the hardware circuitry based on information associated with the event, the dynamically altering of the virtual machine instrumentation comprises changing an instrumentation of a virtual device of the virtual machine running as part of the host virtual system from a first instrumentation of the virtual device to a second instrumentation of the virtual device while preserving a state of the virtual device as perceived by the guest virtual system, wherein the second instrumentation of the virtual device being different from the first instrumentation of the virtual device,
wherein the event comprises a detected behavior that is associated with a particular exploit or a particular exploit type.
8. The computerized method of claim 1 further comprising conducting malware analysis on the object using the virtual machine having the changed instrumentation for the at least one VM process.
9. The computerized method of claim 1 , wherein dynamically altering of the virtual machine instrumentation comprises interrupting a virtual machine (VM) replay to change an instrumentation for at least one virtual machine (VM) process of the virtual machine during malware analysis of a second object different from the object, where the object and the second object are part of the same data flow.
10. An electronic device comprising:
a memory to store information;
a processor adapted to receive information associated with network traffic, the processor to process the stored information and conduct operations on the network traffic, the operations comprise (i) determining, by a virtual machine processed by the processor, an occurrence of an event during malware analysis of an object and the malware analysis includes an analysis of characteristics associated with anomalous behavior of the object during execution of the object within the virtual machine that includes a guest virtual system and a host virtual system, and (ii) dynamically altering at least a host kernel space of an instrumentation of the virtual machine based on information associated with the event, the dynamic altering of the virtual machine instrumentation comprises changing an instrumentation of a virtual device of the virtual machine from a first instrumentation of the virtual device to a second instrumentation of the virtual device while preserving a state of the virtual device as perceived by the guest virtual system, wherein the second instrumentation of the virtual device being different from the first instrumentation of the virtual device,
wherein the event comprises a detected behavior that is associated with a particular exploit or a particular exploit type.
11. The electronic device of claim 10 , wherein the second instrumentation of the virtual device being downloaded from a cloud computing service.
12. The electronic device of claim 10 , wherein the virtual machine instrumentation comprises logic that performs one of a plurality of virtualized operations including (i) controlling virtualized operations conducted on the object associated with content received over a network and (ii) monitoring the virtualized operations conducted on the object.
13. The electronic device of claim 10 , wherein the processor determines the event during malware analysis of the object associated with network traffic by (i) performing a replay operation on the object and (ii) analyzing characteristics associated with anomalous behavior if an exploit associated with the object is detected during the replay operation.
14. The electronic device of claim 13 , wherein the characteristics associated with anomalous behavior comprises at least one of unusual network transmissions from the electronic device and unusual changes in performance by the electronic device.
15. The electronic device of claim 10 , wherein the processor further dynamically altering of the virtual machine instrumentation by at least changing subsequent operations of the virtual machine, running as part of a host virtual system in the electronic device, for detecting exploits associated with the network traffic while preserving state so as to remain transparent to a guest virtual system of the electronic device.
16. The electronic device of claim 10 , wherein the processor further dynamically altering the virtual machine instrumentation so that the virtual machine conducts subsequent analysis on a particular exploit or a family of exploits that are more likely to be present within the network traffic based on prior malware analysis results.
17. The electronic device of claim 10 , wherein the processor further dynamically altering of the virtual machine instrumentation comprises interrupting a virtual machine (VM) replay to at least (i) change an instrumentation for at least one virtual machine (VM) process of the virtual machine during malware analysis of the object and (ii) change the instrumentation during malware analysis of a second object different from the object, where the object and the second object are part of the same data flow.
18. The electronic device of claim 10 , wherein the processor further conducting malware analysis on the object using the virtual machine having the changed instrumentation for the at least one VM process.
19. An electronic device comprising:
a memory to store information;
a processor adapted to receive information associated with network traffic, the processor to process the stored information and conduct operations on the network traffic, the operations comprise (i) determining, by a virtual machine processed by the processor, an occurrence of an event during malware analysis of an object and the malware analysis includes an analysis of characteristics associated with anomalous behavior of the object during execution of the object within the virtual machine that includes a guest virtual system and a host virtual system, and (ii) dynamically altering the host virtual system associated with an instrumentation of the virtual machine based on information associated with the event, the dynamic altering of the virtual machine instrumentation comprises at least changing an instrumentation of a virtual device of the virtual machine from a first instrumentation of the virtual device to a second instrumentation of the virtual device while preserving a state of the virtual device as perceived by the quest virtual system, wherein the second instrumentation of the virtual device being different from the first instrumentation of the virtual device,
wherein the event comprises a detected behavior that is associated with a particular exploit or a particular exploit type.
20. The electronic device of claim 19 , wherein the detection of an exploit during the analysis of the characteristics associated with anomalous behavior of the object during execution of the object within the virtual machine comprises a detection of an exploit causing an overflow condition of a first type of buffer.
21. The electronic device of claim 19 , wherein the processor further dynamically altering of the virtual machine instrumentation by at least changing subsequent operations of the virtual machine, running as part of the host virtual system in the electronic device, for detecting exploits associated with the network traffic while preserving the state of the virtual device so as to remain transparent to the guest virtual system of the electronic device.
22. The electronic device of claim 19 , wherein the processor further dynamically altering the virtual machine instrumentation so that the virtual machine conducts subsequent analysis on a particular exploit or a family of exploits that are more likely to be present within the network traffic based on prior malware analysis results.
23. The electronic device of claim 19 , wherein the processor further dynamically altering of the virtual machine instrumentation comprises interrupting a virtual machine (VM) replay to at least (i) change an instrumentation for at least one virtual machine process of the virtual machine during malware analysis of the object and (ii) change the instrumentation during malware analysis of a second object different from the object, where the object and the second object are part of the same data flow.
24. The electronic device of claim 19 , wherein the second instrumentation of the virtual device having additional functionality from functionality provided by the first instrumentation of the virtual device.
25. The electronic device of claim 19 , wherein the second instrumentation of the virtual device being downloaded from a cloud computing service.
26. The electronic device of claim 19 , wherein the virtual machine instrumentation comprises logic that performs one of a plurality of virtualized operations including (i) controlling virtualized operations conducted on the object associated with content received over a network and (ii) monitoring the virtualized operations conducted on the object.
27. The electronic device of claim 19 , wherein the characteristics associated with anomalous behavior comprises at least one of unusual network transmissions from the electronic device and unusual changes in performance by the electronic device.