Systems and methods for executing arbitrary applications in secure environments
Described systems and methods allow protecting a host system, such as a computer system or smartphone, from malware such as viruses, exploits, and rootkits. In some embodiments, a hypervisor executes at the highest processor privilege level and displaces other software to a guest virtual machine (VM). A security application detects the launch of a target process within the guest VM. In response to the launch, the hypervisor instantiates a process VM isolated from the guest VM, and relocates the target process to the process VM. In some embodiments, when the relocated target process attempts to access a resource, such as a file or registry key, an instance of the respective resource is fetched on-demand, from the guest VM to the respective process VM. Executing the target process within an isolated environment helps to contain malware to the respective environment.
1. A host system comprising at least one processor configured to execute a hypervisor, the hypervisor configured to expose a guest virtual machine (VM) and further configured to:
in response to a launch of a target process within the guest VM, expose a process VM distinct from the guest VM, the process VM comprising a resource request interceptor configured to:
detect an attempt by the target process to access a resource, and
in response to detecting the attempt, transmit an indicator of the resource to the hypervisor;
in response to exposing the process VM, relocate the target process from the guest VM to the process VM; and
in response to relocating the target process, and in response to receiving the indicator of the resource, fetch the resource from the guest VM to the process VM.
2. The host system of claim 1 , wherein the resource comprises a disk file.
3. The host system of claim 1 , wherein the resource comprises a registry key.
4. The host system of claim 1 , wherein fetching the resource comprises copying the resource from the guest VM to the process VM.
5. The host system of claim 1 , wherein fetching the resource comprises mapping the resource from a memory domain of the guest VM to a memory domain of the process VM.
6. The host system of claim 1 , wherein fetching the resource comprises configuring access rights to the resource within the guest VM.
7. The host system of claim 1 , wherein fetching the resource comprises locking the resource within the guest VM so that the target process has exclusive access to the resource for the lifetime of the target process.
8. The host system of claim 1 , wherein the guest VM is configured, in response to the attempt to access the resource, to:
evaluate the resource and the target process to determine whether accessing the resource by the target process violates a predetermined security policy; and
in response, when accessing the resource by the target process does not violate the security policy, to send an indicator of the resource to the hypervisor.
9. The host system of claim 1 , wherein the guest VM is configured, in response to the attempt to access the resource, to:
evaluate the resource and the target process according to a set of malware-identifying criteria to determine whether accessing the resource by the target process is indicative of malice; and
in response, when accessing the resource by the target process is not indicative of malice, to send an indicator of the resource to the hypervisor.
10. The host system of claim 1 , wherein:
the hypervisor is further configured to:
detect an attempt to terminate the target process,
in response, identify a modification to the resource, the modification operated during execution of the target process, and
in response to identifying the modification, send the modification to the guest VM; and
the guest VM is configured to:
in response to receiving the modification, determine whether the modification comprises malware, and
when the modification does not comprise malware, save the modification to a storage device used by guest VM.
11. A method comprising:
employing at least one processor of a host system to execute a hypervisor, the hypervisor configured to expose a guest virtual machine (VM);
in response to a launch of a target process within the guest VM, employing the at least one processor to expose a process VM distinct from the guest VM, the process VM comprising a resource request interceptor configured to:
detect an attempt by the target process to access a resource, and
in response to detecting the attempt, transmit an indicator of the resource to the hypervisor;
in response to exposing the process VM, employing the at least one processor to relocate the target process from the guest VM to the process VM; and
in response to relocating the target process, and in response to the hypervisor receiving the indicator of the resource, employing the at least one processor to fetch the resource from the guest VM to the process VM.
12. The method of claim 11 , wherein the resource comprises a disk file.
13. The method of claim 11 , wherein the resource comprises a registry key.
14. The method of claim 11 , wherein fetching the resource comprises copying the resource from the guest VM to the process VM.
15. The method of claim 11 , wherein fetching the resource comprises mapping the resource from a memory domain of the guest VM to a memory domain of the process VM.
16. The method of claim 11 , wherein fetching the resource comprises configuring access rights to the resource within the guest VM.
17. The method of claim 11 , wherein fetching the resource comprises locking the resource within the guest VM so that the target process has exclusive access to the resource for the lifetime of the target process.
18. The method of claim 11 , further comprising, in response to the attempt to access the resource:
employing the at least one processor to evaluate the resource and the target process to determine whether accessing the resource by the target process violates a predetermined security policy; and
in response, when accessing the resource by the target process does not violate the security policy, employing the at least one processor to send an indicator of the resource to the hypervisor.
19. The method of claim 11 , further comprising, in response to the attempt to access the resource:
employing the at least one processor to evaluate the resource and the target process according to a set of malware-identifying criteria to determine whether accessing the resource by the target process is indicative of malice; and
in response, when accessing the resource by the target process is not indicative of malice, employing the at least one processor to send an indicator of the resource to the hypervisor.
20. The method of claim 11 , further comprising:
employing the at least one processor to detect an attempt to terminate the target process;
in response to detecting the attempt to terminate the target process, employing the at least one processor to identify a modification to the resource, the modification operated during execution of the target process;
in response to identifying the modification, employing the at least one processor to determine whether the modification comprises malware; and
in response, when the modification does not comprise malware, employing the at least one processor to save the modification to a storage device used by the guest VM.
21. A non-transitory computer readable medium storing instructions which, when executed, cause a host system comprising at least one processor to execute a hypervisor, the hypervisor configured to expose a guest virtual machine (VM) and further configured to:
in response to a launch of a target process within the guest VM, expose a process VM distinct from the guest VM, the process VM comprising a resource request interceptor configured to:
detect an attempt by the target process to access a resource, and
in response to detecting the attempt, transmit an indicator of the resource to the hypervisor;
in response to exposing the guest VM, relocate the target process from the guest VM to the process VM; and
in response to relocating the target process, and in response to receiving the indicator of the resource, fetch the resource from the guest VM to the process VM.
22. A host system comprising at least one processor configured to execute a hypervisor, the hypervisor configured to expose a guest virtual machine (VM) and a process VM, and further configured to:
in response to a launch of a target process within the guest VM, relocate the target process from the guest VM to the process VM;
in response to relocating the target process, and in response to receiving from the process VM a request to access a resource, transmit the request to the guest VM;
in response to transmitting the request to the guest VM, receive from the guest VM an indicator of the resource; and
in response to receiving the indicator of the resource, fetch the resource from the guest VM to the process VM,
wherein the guest VM comprises an evaluating module configured to:
in response to receiving the request from the process VM, evaluate the resource and the target process to determine whether accessing the resource by the target process poses a computer security threat, and
in response, when accessing the resource by the target process does not pose a computer security threat, transmit the indicator of the resource to the hypervisor.