Methods and apparatus for application isolation
Processor(s) for detecting malicious software. A hardware virtual machine monitor (HVMM) operates under a host OS. Container(s) initialized with network application template(s) operate under a guest OS VM. A detection module operates under the guest OS VM includes a trigger detection module, a logging module and a container command module. The trigger detection module monitors activity on container(s) for a trigger event. The logging module writes activity report(s) in response to trigger event(s). The container command module issues command(s) in response to trigger event(s). The command(s) include a container start, stop and revert commands. A virtual machine control console operates under the host OS and starts/stops the HVMM. A container control module operates under the guest OS VM and controls container(s) in response to the command(s). The server communication module sends activity report(s) to a central collection network appliance that maintains a repository of activities for infected devices.
1. A system for detecting malicious software comprising:
a) at least one network application template, the at least one network application template including:
i) a modifiable section; and
ii) a non-modifiable section;
b) an application processor comprising:
i) a virtual machine monitor to execute on a hardware computing machine under control of a host operating system;
ii) at least one container:
(1) to execute in a protected memory space under control of a guest operating system virtual machine;
(2) initialized with at least one copy of the at least one network application template; and
(3) including:
(a) a file system; and
(b) a network address;
iii) a detector to execute under control of the guest operating system virtual machine, the detector of the application processor to:
(1) monitor activity on the at least one container for a trigger event;
(2) write an indication of the activity to an activity report in response to the trigger event; and
(3) conditionally issue at least one command in response to the trigger event, the at least one command being at least one of the following:
(a) a container stop command;
(b) a container revert command; and
(c) a container start command;
iv) a virtual machine control console to:
(1) operate under control of the host operating system; and
(2) start and stop the virtual machine monitor;
v) a container controller to:
(1) operate under control of the guest operating system virtual machine;
(2) start the at least one container in response to the container start command;
(3) stop the at least one container in response to the container stop command; and
(4) revert the at least one container in response to the container revert command; and
the application processor to transmit the activity report over a network to a central collection network appliance to store the indication of the activity from the activity report in a repository of activities for infected devices.
2. A system according to claim 1 , further including a shared persistent directory to operate under control of the host operating system, the shared persistent directory accessible by the at least one container.
3. A system according to claim 2 , wherein access to the shared persistent directory is limited.
4. A system according to claim 1 , wherein the central collection network appliance further analyzes the activity report to determine a set of new trigger events.
5. A system according to claim 4 , wherein the central collection network appliance further transmits at least one new trigger event from the set of new trigger events to at least one network traffic appliance.
6. A system according to claim 1 , wherein the container start command is initiated by the host operating system.
7. A system according to claim 1 , wherein the at least one container is a private container, the private container to have private semi-persistent storage.
8. A system according to claim 1 , wherein the at least one container is a public container, the public container to access persistent storage.
9. A system according to claim 1 , wherein the detector of the application processor monitors at least one of the following:
a) unauthorized changes to the non-modifiable section;
b) registry writes;
c) a start of new processes;
d) web sites visited;
e) redirected URLs;
f) infection details;
g) event timelines;
h) network connections;
i) file system writes; and
j) configuration changes.
10. A system according to claim 1 , wherein the activity report includes an indication of at least one of the following:
a) unauthorized changes to the non-modifiable section;
b) registry writes;
c) a start of new processes;
d) web sites visited;
e) redirected URLs;
f) Infection details;
g) event timelines;
h) network connections;
i) file system writes; and
j) configuration changes.
11. A system according to claim 1 , wherein a display of the at least one container is displayed by the host operating system.
12. A system according to claim 1 , wherein at least one virtual machine window is hidden.
13. A system according to claim 1 , wherein a guest operating system of the guest operating system virtual machine and the host operating system are different.
14. A system according to claim 1 , wherein the activity report is searchable by at least one of the following:
a) an MD5 hash;
b) a time interval;
c) a web site;
d) a host;
e) a process name; and
f) a remote connection.
15. A system according to claim 1 , wherein the at least one container resides on a rewritable external storage medium.
16. An apparatus for detecting malicious software comprising:
a) an appliance processor of a hardware computing machine;
b) a hardware virtual machine monitor to execute on the appliance processor of the hardware computing machine under control of a host operating system;
c) at least one network application template, the at least one network application template including:
i) a modifiable section; and
ii) a non-modifiable section;
d) at least one container to execute on the appliance processor, the at least one container:
i) to operate in a protected memory space under control of a guest operating system virtual machine;
ii) initialized with at least one copy of the at least one network application template; and
iii) including:
(1) a file system; and
(2) a network address;
e) a detector to execute on the appliance processor, the detector to execute under control of the guest operating system virtual machine, the detector of the appliance processor to:
i) monitor activity on the at least one container for a trigger event;
ii) write an indication of the activity to an activity report in response to the trigger event; and
iii) conditionally issue at least one command in response to the trigger event, the at least one command being at least one of the following:
(1) a container stop command;
(2) a container revert command; and
(3) a container start command;
f) a virtual machine control console to execute on the appliance processor, the virtual machine control console to:
i) operate under control of the host operating system; and
ii) start and stop the hardware virtual machine monitor;
g) a container controller to execute on the appliance processor, the container controller to:
i) operate under control of the guest operating system virtual machine;
ii) start the at least one container in response to the container start command;
iii) stop the at least one container in response to the container stop command; and
iv) revert the at least one container in response to the container revert command; and
the hardware computing machine to send the activity report to a central collection network appliance over a network to store the indication of the activity from the activity report in a repository of activities for infected devices.
17. An apparatus according to claim 16 , further including a shared persistent directory to operate under control of the host operating system, the shared persistent directory accessible by the at least one container.
18. An apparatus according to claim 16 , wherein the container start command is initiated by the host operating system.
19. An apparatus according to claim 16 , wherein the at least one container is a private container, the private container having private semi-persistent storage.
20. An apparatus according to claim 16 , wherein the detector monitors at least one of the following:
a) unauthorized changes to the a non-modifiable section;
b) registry writes;
c) a start of new processes;
d) web sites visited;
e) redirected URLs;
f) infection details;
g) event timelines;
h) network connections;
i) file system writes; and
j) configuration changes.