Method, device, and system of differentiating between virtual machine and non-virtualized device
Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a cyber-attacker. An end-user device (a desktop computer, a laptop computer, a smartphone, a tablet, or the like) interacts and communicates with a server of a computerized server (a banking website, an electronic commerce website, or the like). The interactions are monitored, tracked and logged. Communication interferences are intentionally introduced to the communication session; and the server tracks the response or the reaction of the end-user device to such communication interferences. The system determines whether the user is a legitimate human user; or a cyber-attacker posing as a legitimate human user but actually utilizing a Virtual Machine.
1. A method comprising:
determining whether a user, who utilizes a computing device to interact with a computerized service, (A) is a user interacting with a non-virtualized computing device, or (B) is a Virtual Machine (VM) running on top of a Virtual Machine Monitor (VMM);
wherein the determining comprises:
generating and introducing an interference into a communication session between the computerized service and the computing device;
monitoring response of the computing device to said interference;
based on the monitored response, determining whether said user, who utilizes the computing device to interact with a computerized service, (A) is a user interacting with a non-virtualized computing device, or (B) is a Virtual Machine (VM) running on top of a Virtual Machine Monitor (VMM).
2. The method of claim 1 , wherein generating the interference comprises duplicating a packet in said communication session between the computerized service and the computing device; wherein the determining comprises:
based on the response of the computing device to said interference of a duplicated packet, determining whether said user, who utilizes the computing device to interact with a computerized service, (A) is a user interacting with a non-virtualized computing device, or (B) is a Virtual Machine (VM) running on top of a Virtual Machine Monitor (VMM).
3. The method of claim 1 , wherein generating the interference comprises intentionally dropping a packet in said communication session between the computerized service and the computing device; wherein the determining comprises:
based on the response of the computing device to said interference of a dropped packet, determining whether said user, who utilizes the computing device to interact with a computerized service, (A) is a user interacting with a non-virtualized computing device, or (B) is a Virtual Machine (VM) running on top of a Virtual Machine Monitor (VMM).
4. The method of claim 1 , wherein generating the interference comprises inserting an error code into said communication session between the computerized service and the computing device;
wherein the determining comprises: based on the response of the computing device to said interference of error code insertion, determining whether said user, who utilizes the computing device to interact with a computerized service, (A) is a user interacting with a non-virtualized computing device, or (B) is a Virtual Machine (VM) running on top of a Virtual Machine Monitor (VMM).
5. The method of claim 1 , wherein generating the interference comprises generating network congestion in said communication session between the computerized service and the computing device;
wherein the determining comprises: based on the response of the computing device to said interference of network congestion, determining whether said user, who utilizes the computing device to interact with a computerized service, (A) is a user interacting with a non-virtualized computing device, or (B) is a Virtual Machine (VM) running on top of a Virtual Machine Monitor (VMM).
6. The method of claim 1 , wherein generating the interference comprises slowing-down network transport in said communication session between the computerized service and the computing device;
wherein the determining comprises: based on the response of the computing device to said interference of slowed-down network transport, determining whether said user, who utilizes the computing device to interact with a computerized service, (A) is a user interacting with a non-virtualized computing device, or (B) is a Virtual Machine (VM) running on top of a Virtual Machine Monitor (VMM).
7. The method of claim 1 , wherein generating the interference comprises generating latency in said communication session between the computerized service and the computing device;
wherein the determining comprises: based on the response of the computing device to said interference of latency, determining whether said user, who utilizes the computing device to interact with a computerized service, (A) is a user interacting with a non-virtualized computing device, or (B) is a Virtual Machine (VM) running on top of a Virtual Machine Monitor (VMM).
8. The method of claim 1 , wherein generating the interference comprises generating a communication error that causes a Virtual Machine Monitor (VMM) to handle the communication error without passing the communication error for handling by an underlying Virtual Machine (VM);
based on the handling of said communication error, determining that the computing device is a Virtual Machine (VM) running on a Virtual Machine Monitor (VMM).
9. The method of claim 1 , comprising:
generating a communication error that causes a packet to be handled by both (i) a virtualized network card of a Virtual Machine (VM), and (ii) a hardware network card of a computer on which said Virtual Machine (VM) is running;
detecting dual-handling of said packet due to said communication error;
based on said dual-handling, determining that said computing device is a Virtual Machine (VM).
10. The method of claim 1 , comprising:
generating a communication error that causes a packet to be handled by both (i) a virtualized driver of a Virtual Machine (VM), and (ii) a non-virtualized driver of a computer on which said Virtual Machine (VM) is running;
detecting dual-handling of said packet due to said communication error;
based on said dual-handling, determining that said computing device is a Virtual Machine (VM).
11. The method of claim 1 , comprising:
determining whether said computing device is defined by utilizing Network Address Translation (NAT) or by utilizing bridged networking;
based on a determination that said computing device is defined by utilizing Network Address Translation (NAT), determining that said computing device is a Virtual Machine (VM).
12. The method of claim 1 , comprising:
generating a communication error that is typically handled by an end-user device at a communication layer that is higher than data link layer (L2);
monitoring the handling of said communication error by said computing device;
detecting that said communication error was handled at the data link layer (L2);
based on said detecting, determining that said computing device is a Virtual Machine (VM).
13. The method of claim 1 , comprising:
measuring a time-to-live (TTL) value of packets transported from said computerized service to said computing device;
based on said TTL value, determining whether said user, who utilizes the computing device to interact with a computerized service, (A) is a user interacting with a non-virtualized computing device, or (B) is a Virtual Machine (VM) running on top of a Virtual Machine Monitor (VMM).
14. The method of claim 1 , comprising:
measuring a Transmission Control Protocol (TCP) window size of said computing device;
based on said TCP window size of said computing device, determining whether said user, who utilizes the computing device to interact with a computerized service, (A) is a user interacting with a non-virtualized computing device, or (B) is a Virtual Machine (VM) running on top of a Virtual Machine Monitor (VMM).
15. The method of claim 1 , comprising:
storing in a repository profiles of multiple computing stacks of Virtual Machines (VMs);
during the communication session between said computerized service and said computing device, generating an ad-hoc computing stack profile of said computing device;
if the ad-hoc computing stack profile of said computing device matches a previously-stored profile of computing stack of Virtual Machine (VM), then determining that said computing device is a Virtual Machine (VM).
16. The method of claim 1 , comprising:
storing in a repository profiles of multiple computing stacks of non-virtualized computing platforms;
during the communication session between said computerized service and said computing device, generating an ad-hoc computing stack profile of said computing device;
if the ad-hoc computing stack profile of said computing device matches a previously-stored profile of a computing stack of non-virtualized computing platform, then determining that said computing device is a non-virtualized computing platform.
17. The method of claim 1 , comprising:
estimating two or more parameters of a computing stack of said computing device;
generating a weighted score based on said two or more parameters of the computing stack of said computing device;
if the weighted score matches a previously-calculated score that typically characterizes a Virtual Machine (VM), then determining that said computing device is a Virtual Machine (VM).
18. The method of claim 1 , comprising:
causing said computing device to perform a processing-intensive process, and monitoring progress of said processing-intensive process;
based on monitored progress of said processing-intensive process, estimating whether said computing device is a single-core computing device or a multiple-core computing device;
if it is estimated that said computing device is a single-core computing device, then determining that said computing device is a Virtual Machine (VM).
19. The method of claim 1 , comprising:
causing said computing device to perform a resource-overloading process, and monitoring progress of said resource-overloading process;
based on monitored progress of said processing-intensive process, estimating whether said computing device is a high-resource computing device or a low-resource computing device;
if it is estimated that said computing device is a low-resource computing device, then determining that said computing device is a Virtual Machine (VM).
20. The method of claim 1 , comprising:
causing said computing device to invoke a process that attempts to directly access a graphics card of said computing device;
monitoring whether or not said process successfully accessed directly the graphics card of said computing device;
if it is detected that said process did not successfully access directly the graphics card of said computing device, then determining that said computing device is a Virtual Machine (VM).
21. The method of claim 1 , comprising:
causing said computing device to invoke a process that attempts to draw a particular on-screen graphic item that can be drawn only by direct access to a graphics card of said computing device;
monitoring whether or not said process successfully drew said graphic item;
if it is detected that said process did not successfully draw said graphic item, then determining that said computing device is a Virtual Machine (VM).