Exploit detection system with threat-aware microvisor
View Patent ↗An exploit detection system deploys a threat-aware microvisor to facilitate real-time security analysis, including exploit detection and threat intelligence, of an operating system process executing on a node of a network environment. The microvisor may be organized as a main protection domain representative of the operating system process. In response to the process attempting to access a kernel resource for which it does not have permission, a capability violation may be generated at the main protection domain of the microvisor and a micro-virtual machine (VM) may be spawned as a container configured to encapsulate the process. The main protection domain may then be cloned to create a cloned protection domain that is representative of the process and that is bound to the spawned micro-VM. Capabilities of the cloned protection domain may be configured to be more restricted than the capabilities of the main protection domain with respect to access to the kernel resource. The restricted capabilities may be configured to generate more capability violations than those generated by the capabilities of the main protection domain and, in turn, enable further monitoring of the process as it attempts to access the kernel resource.
1. A system comprising:
a central processing unit (CPU) of an exploit detection system;
a memory coupled to the CPU and configured to store:
a threat-aware microvisor executable by the CPU to generate a capability violation in response to a process executing in an operating system attempting to access a kernel resource for which the process does not have permission, the threat-aware microvisor having a main protection domain including one or more execution contexts and capabilities defining permissions for the process to access the kernel resource;
a virtual machine monitor (VMM) executable by the CPU to, in response to the capability violation, spawn a micro-virtual machine as a container configured to encapsulate the process, the micro-virtual machine further configured to monitor operation of the process as the process attempts to access the kernel resource to detect whether the process includes an exploit; and
a cloned protection domain representative of the process, the cloned protection domain created by copying the execution contexts and capabilities of the main protection domain, wherein the capabilities of the cloned protection domain are more restricted than the capabilities of the main protection domain with respect to access to the kernel resource, and wherein the restricted capabilities of the cloned protection domain are configured to generate more capability violations than the capability violation generated by the capabilities of the main protection domain.
2. The system of claim 1 wherein the VMM further comprises:
instrumentation logic configured to determine a likelihood that the process contains the exploit based on an application of heuristics.
3. The system of claim 2 wherein the kernel resource is a memory page and wherein the instrumentation logic is further configured to:
determine whether the memory page includes information selected from one of (i) just-in-time compiler program instructions and just-in-time compiler headers, and (ii) non-standard program instruction sequences and unusual headers; and
in response to determining that the memory page includes non-standard program instructions and unusual headers, determining that the process likely contains the exploit.
4. The system of claim 2 wherein the micro-virtual machine is spawned in response to determining that the process likely contains the exploit.
5. The system of claim 1 wherein the VMM is further configured to analyze one or more interception points originated by the process to invoke one or more services of the operating system to access the kernel resource, wherein the one or more interception points include one of a memory access request, a function call and a system call.
6. The system of claim 1 wherein the threat-aware microvisor and VMM execute on a node of a network environment and wherein the node is embodied as an endpoint.
7. A method comprising:
organizing a microvisor of an exploit detection system having a processor and a memory as a main protection domain representative of a process executing in an operating system of the exploit detection system, the microvisor and operating system stored in the memory and executable by the processor, the main protection domain including one or more execution contexts and capabilities defining permissions for the process to access kernel resources of the exploit detection system;
generating a capability violation at the main protection domain in response to the process attempting to access a kernel resource for which the process does not have permission;
in response to the capability violation, spawning a micro-virtual machine as a container configured to encapsulate the process;
cloning the main protection domain by copying the execution contexts and capabilities to create a cloned protection domain representative of the process, wherein the capabilities of the cloned protection domain are more restricted than the capabilities of the main protection domain with respect to access to the kernel resources, and wherein the restricted capabilities of the cloned protection domain are configured to generate more capability violations than the capability violation generated by the capabilities of the main protection domain;
binding the spawned micro-virtual machine to the cloned protection domain of the microvisor; and
monitoring operation of the process encapsulated in the micro-virtual machine as the process attempts to access the kernel resource to determine whether the process includes an exploit.
8. The method of claim 7 wherein generating a capability violation comprises:
generating a trap by a central processing unit of the exploit detection system; and
servicing the generated trap by an exception handler of the microvisor.
9. The method of claim 7 further comprising:
instantiating a virtual machine as a first module configured as a container for the operating system and the kernel resources, and further configured to support execution of an operating system kernel of the exploit detection system.
10. The method of claim 9 wherein spawning the micro-virtual machine comprises:
creating an instance of a second module substantially similar to the first module of the virtual machine, the second module having instrumentation logic directed to determination of the exploit.
11. The method of claim 10 wherein binding comprises binding of the spawned micro-virtual machine to the cloned protection domain of the microvisor through memory context switching.
12. The method of claim 10 further comprising:
allocating a shadow memory for use by the micro-virtual machine to analyze the process.
13. The method of claim 12 further comprising:
logging the capability violations in a system logger of the exploit detection system.
14. A system comprising:
a memory configured to store a process, an operating system kernel, a virtual machine monitor (VMM) and a microvisor, the microvisor organized as a main protection domain representative of the process and including one or more execution contexts and capabilities defining permissions for the process to access kernel resources of the system;
a central processing unit (CPU) coupled to the memory and adapted to execute the process, the operating system kernel, the VMM and the microvisor, wherein the VMM and the microvisor are configured to:
generate one or more capability violations at the main protection domain in response to the process attempting to access one or more kernel resources for which the process does not have permission;
in response to the one or more capability violations, spawn a micro-virtual machine as a container configured to encapsulate the process;
clone the main protection domain by copying the execution contexts and capabilities to create a cloned protection domain representative of the process, wherein the capabilities of the cloned protection domain are more restricted than the capabilities of the main protection domain with respect to access to the kernel resources, and wherein the restricted capabilities of the cloned protection domain are configured to generate further capability violations than the one or more capability violations generated by the capabilities of the main protection domain; and
cooperate with the micro-virtual machine to monitor operation of the process encapsulated in the micro-virtual machine as the process attempts to access the kernel resource to determine whether the process includes an exploit.
15. The system of claim 14 wherein the process is configured to:
originate one or more interception points to invoke one or more services of the operating system kernel to access the one or more kernel resources.
16. The system of claim 15 wherein the one or more interception points comprises a system call at which a switch occurs from a privilege level of the process to a privilege level of the operating system kernel.
17. The system of claim 16 wherein the VMM is further configured to:
instantiate a virtual machine as a first module configured as a container for the operating system kernel and the kernel resources, and further configured to support execution of the operating system kernel.
18. The system of claim 17 wherein the VMM is further configured to:
create an instance of a second module substantially similar to the first module of the virtual machine, the second module having instrumentation logic directed to determination of the exploit.
19. The system of claim 18 wherein the VMM is further configured to:
intercept the system call;
generate a hyper-call; and
pass the hyper-call over a privileged interface to the microvisor to enable the main protection domain of the microvisor to control access to the one or more kernel resources.
20. The system of claim 19 wherein the microvisor is further configured to:
check permission of the process to access the one or more kernel resources;
allowing the access if the process has permission to access the one or more kernel resources; and
report the one or more capability violations to the VMM over the privileged interface if the process does not have permission to access the one or more kernel resources.
21. The system of claim 15 wherein the VMM is further configured to:
collect the one or more capability violations in response to the one or more interception points to evaluate a state of the process in order to detect the exploit.
22. A method comprising:
organizing a microvisor as a main protection domain representative of an operating system process executing in a user space of an exploit detection system having a processor and a memory, the main protection domain including one or more execution contexts and capabilities defining permissions for the operating system process to access kernel resources of the exploit detection system, the microvisor and operating system process stored in the memory and executable by the processor, the microvisor executing in a kernel space of the exploit detection system;
instantiating a virtual machine (VM 0) as a container for an operating system kernel, the VM 0 instantiated by a virtual machine monitor (VMM) configured to expose the kernel resources to the operating system kernel, the VMM and VM 0 executing in the user space of the exploit detection system;
originating an interception point by the operating system process to invoke a service of the operating system kernel to access a first kernel resource;
generating a capability violation at the main protection domain of the microvisor in response to the operating system process not having permission to access the first kernel resource;
in response to the capability violation, spawning a micro-virtual machine as a container configured to encapsulate the operating system process;
cloning the main protection domain to create a cloned protection domain representative of the operating system process, wherein the capabilities of the cloned protection domain are more restricted than the capabilities of the main protection domain with respect to access to the kernel resources, and wherein the more restricted capabilities of the cloned protection domain are configured to generate more capability violations than the capability violation generated by the capabilities of the main protection domain;
monitoring operation of the operating system process encapsulated in the micro-virtual machine as the process attempts to access a second kernel resource; and
in response to the operating system process encapsulated in the micro-virtual machine attempting to access the second kernel resource, generating at least one capability violation of the more restricted capabilities at the cloned protection domain to thereby enable detection of anomalous behavior of the process.
23. The method of claim 22 further comprising, wherein the interception point includes a system call:
decomposing the operating system process into a plurality of threads;
sending the system call to the operating system kernel requesting access to a kernel resource; and
intercepting the system call at the VMM.
24. The method of claim 23 further comprising:
generating a hyper-call at the VMM;
passing the hyper-call over a privileged interface to the main protection domain of the microvisor, wherein the hyper-call enables switching from the user space of the exploit detection system to the kernel space of the system;
checking the permission of a thread to access the kernel resource; and
allowing the access if the thread has permission to access the kernel resource.
25. The method of claim 23 wherein generating the capability violation at the main protection domain comprises:
reporting the capability violation to the VMM over a privileged interface; and
assuming control over the operating system kernel at the VMM to enable monitoring of activity of the thread of the operating system process.
26. The method of claim 22 wherein the first kernel resource is different from the second kernel resource.
27. A non-transitory computer readable media containing instructions for execution on a processor for a method comprising:
organizing a microvisor of an exploit detection system as a main protection domain representative of a process executing in an operating system of the exploit detection system, the main protection domain including one or more execution contexts and capabilities defining permissions for the process to access kernel resources of the exploit detection system;
generating a capability violation at the main protection domain in response to the process attempting to access a kernel resource for which the process does not have permission;
in response to the capability violation, spawning a micro-virtual machine as a container configured to encapsulate the process;
cloning the main protection domain by copying the execution contexts and capabilities to create a cloned protection domain representative of the process, wherein the capabilities of the cloned protection domain are more restricted than the capabilities of the main protection domain with respect to access to the kernel resources, and wherein the restricted capabilities of the cloned protection domain are configured to generate more capability violations than the capability violation generated by the capabilities of the main protection domain; and
monitoring operation of the process encapsulated in the micro-virtual machine as the process attempts to access the kernel resource to determine whether the process includes an exploit.