Detecting arbitrary code execution using a hypervisor
View Patent ↗The subject matter described herein provides protection against zero-day attacks by detecting, via a hypervisor maintaining an extended page table, an attempt to execute arbitrary code associated with malware in a guest operation system (OS) running within a virtual machine (VM). Further, the subject matter provides detection of lateral movement of the malware. The hypervisor uses hidden breakpoints to detect a request for thread creation, and then determines whether the request is to download and execute arbitrary code.
1. A system for hypervisor detection of attempted arbitrary code execution in zero-day exploits, said system comprising:
at least one physical processor; and
at least one memory comprising computer program code, the at least one memory and the computer program code configured to, with the at least one physical processor, cause the physical processor to at least:
generate, by a hypervisor, an extended page table (EPT) violation in response to an attempt by a process in a guest operating system (OS) to execute an instruction in a guest physical page (GPP);
in response to the generated EPT violation, obtain process context for the process, the process context identifying a set of modules associated with the process;
determine whether the instruction is within any of the identified set of modules; and
upon determining that the instruction is outside the identified set of modules, classify the attempt as arbitrary code execution associated with malware.
2. The system of claim 1 , wherein the hypervisor converts virtual addresses in virtual memory into physical addresses in physical memory, and wherein permissions are lazily mirrored between the virtual memory and the physical memory.
3. The system of claim 1 , wherein the EPT violation is generated when the GPP lacks a corresponding host physical page (HPP) or has a corresponding HPP that lacks execute permission.
4. The system of claim 1 , wherein the computer program code is configured to determine that the instruction to be executed is located within a stack, and classify the attempt as arbitrary code execution.
5. The system of claim 1 , wherein the computer program code is configured to notify a security monitor system to quarantine the guest OS or quarantine a virtual machine that runs the guest OS after classifying the attempt as arbitrary code execution.
6. The system of claim 1 , wherein the computer program code is configured to determine whether the instruction is within any of the identified set of modules by checking whether an instruction pointer associated with the instruction points to a legitimate code region associated with the identified set of modules.
7. The system of claim 1 , wherein the computer program code is further configured to update an entry in the EPT for a corresponding HPP with execute permission to allow the instruction to execute, and restart the instruction.
8. A method for hypervisor detection of attempted arbitrary code execution in zero-day exploits, said method comprising:
generating, by a hypervisor, an extended page table (EPT) violation in response to an attempt by a process in a guest operating system (OS) to execute an instruction in a guest physical page (GPP);
in response to the generated EPT violation, obtaining process context for the process, the process context identifying a set of modules associated with the process;
determining whether the instruction is within any of the identified set of modules; and
upon determining that the instruction is outside the identified set of modules, classifying the attempt as arbitrary code execution associated with malware.
9. The method of claim 8 , wherein the hypervisor converts virtual addresses in virtual memory into physical addresses in physical memory, and wherein permissions are lazily mirrored between the virtual memory and the physical memory.
10. The method of claim 8 , wherein the EPT violation is generated when the GPP lacks a corresponding host physical page (HPP) or has a corresponding HPP that lacks execute permission.
11. The method of claim 8 , wherein determining comprises determining that the instruction to be executed is located within a stack, and classifying the attempt as arbitrary code execution.
12. The method of claim 8 , further comprising notifying a security system monitor to quarantine the guest OS or quarantine a virtual machine that runs the guest OS after classifying the attempt as arbitrary code execution.
13. The method of claim 8 , wherein determining whether the instruction is within any of the identified set of modules comprises checking whether an instruction pointer associated with the instruction points to a legitimate code region associated with the identified set of modules.
14. The method of claim 8 , further comprises updating an entry in the EPT for a corresponding HPP with execute permission to allow the instruction to execute, and restarting the instruction.
15. One or more non-transitory computer storage media having computer-executable instructions that, upon execution by a processor, cause the processor to at least perform operations comprising:
generating, by a hypervisor, an extended page table (EPT) violation in response to an attempt by a process in a guest operating system (OS) to execute an instruction in a guest physical page (GPP);
in response to the generated EPT violation, obtaining process context for the process, the process context identifying a set of modules associated with the process;
determining whether the instruction is within any of the identified set of modules; and
upon determining that the instruction is outside the identified set of modules, classifying the attempt as arbitrary code execution associated with malware.
16. The one or more non-transitory computer storage media of claim 15 , wherein the hypervisor converts virtual addresses in virtual memory into physical addresses in physical memory, and wherein permissions are lazily mirrored between the virtual memory and the physical memory.
17. The one or more non-transitory computer storage media of claim 15 , wherein the EPT violation is generated when the GPP lacks a corresponding host physical page (HPP) or has a corresponding HPP that lacks execute permission.
18. The one or more non-transitory computer storage media of claim 15 , wherein the operations comprise determining that the instruction to be executed is located within a stack, and classifying the attempt as arbitrary code execution.
19. The one or more non-transitory computer storage media of claim 15 , wherein the operations comprise notifying a security system monitor to quarantine the guest OS or quarantine a virtual machine that runs the guest OS after classifying the attempt as arbitrary code execution.
20. The one or more non-transitory computer storage media of claim 15 , wherein the operations comprise determining whether the instruction is within any of the identified set of modules by checking whether an instruction pointer associated with the instruction points to a legitimate code region associated with the identified set of modules.