Method and system for data collection using hypervisor
Methods, systems, and computing platforms for data collection are disclosed. The system may include one or more hardware and virtual processors configured by machine-readable instructions. The processor(s) may be configured to electronically launch at least one virtual machine operatively connected to a virtualization layer. The processor(s) may be configured to electronically create a virtual disk for the at least one virtual machine connected to the virtualization layer so as to receive a plurality of artifact data.
1. A computer implemented method of data collection in a virtualization computing environment, comprising steps of:
electronically launching at least one virtual machine operatively connected to a virtualization layer;
electronically converting a stateless at least one virtual machine to a persistent at least one virtual machine;
electronically quarantining the at least one virtual machine into a quarantine network;
electronically capturing a plurality of digital memory attribute artifact data of a virtual disk of the persistent at least one virtual machine connected to the virtualization layer;
electronically capturing digital content associated with the persistent the at least one virtual machine so as to capture a plurality of console activity attribute artifact data;
electronically capturing digital packet data from a fault tolerant network so as to capture a plurality of CPU attribute artifact data; and
electronically capturing the plurality of digital memory attribute artifact data, the plurality of console activity attribute artifact data, and the plurality of CPU attribute artifact data to an immutable storage;
electronically processing the plurality of digital memory attribute artifact data, the plurality of user activity attribute artifact data, and the plurality of CPU attribute artifact data with a deep machine learning appliance using neutral networks so as to output a forensic dynamic attribute data set for the persistent at least one virtual machine; determining at least one forensic dynamic attribute data set to remove from the forensic dynamic attribute data set and electronically reverting to the stateless at least one virtual machine.
2. The method of claim 1 , further comprising electronically capturing a plurality of digital log attribute artifact data from the persistent the at least one virtual machine connected to the virtualization layer.
3. The method of claim 1 , further comprising electronically capturing a plurality of digital log attribute artifact data based on a threshold period of time from the persistent at least one virtual machine connected to the virtualization layer.
4. A system configured for data collection in a virtualization environment, the system comprising:
one or more hardware processors configured by machine-readable instructions to: electronically launch at least one virtual machine operatively connected to a virtualization layer;
electronically convert a stateless at least one virtual machine to a persistent at least one virtual machine and quarantine the at least one virtual machine into a network;
electronically capture a plurality of digital memory attribute artifact data of a virtual disk of the persistent at least one virtual machine connected to the virtualization layer;
electronically capture digital content associated with the persistent the at least one virtual machine so as to capture a plurality of console activity attribute artifact data;
electronically capture the digital packet data from a fault tolerant network so as to capture a plurality of CPU attribute artifact data; and
electronically capture the plurality of digital memory attribute artifact data, the plurality of console activity attribute artifact data, and the plurality of CPU attribute artifact data into an immutable storage;
electronically processing the plurality of digital memory attribute artifact data, the plurality of user activity attribute artifact data, and the plurality of CPU attribute artifact data with a deep machine learning appliance using neutral networks so as to output a forensic dynamic attribute data set for the persistent at least one virtual machine; determining at least one forensic dynamic attribute data set to remove from the forensic dynamic attribute data set and electronically reverting to the stateless at least one virtual machine.
5. The system of claim 4 , wherein the one or more hardware processors are further configured by machine-readable instructions to electronically capture a plurality of digital log attribute artifact data from the persistent at least one virtual machine connected to the virtualization layer.
6. The system of claim 4 , wherein the one or more hardware processors are further configured by machine-readable instructions to electronically capture a plurality of digital log attribute artifact data based on a threshold period of time from the persistent at least one virtual machine connected to the virtualization layer.
7. A computing platform configured for data collection in a virtualization environment, the computing platform comprising:
a non-transient computer-readable storage medium having executable instructions embodied thereon; and
one or more hardware processors configured to execute the instructions to:
electronically launch at least one virtual machine operatively connected to a virtualization layer;
electronically convert a stateless at least one virtual machine to a persistent at least one virtual machine and quarantine the at least one virtual machine into a network;
electronically capture a plurality of digital memory attribute artifact data of a virtual disk of the persistent at least one virtual machine connected to the virtualization layer;
electronically capture digital content associated with the persistent the at least one virtual machine so as to capture a plurality of console activity attribute artifact data;
electronically capture the digital packet data from a fault tolerant network so as to capture a plurality of CPU attribute artifact data; and
electronically capture the plurality of digital memory attribute artifact data, the plurality of console activity attribute artifact data, and the plurality of CPU attribute artifact data into an immutable storage;
electronically processing the plurality of digital memory attribute artifact data, the plurality of user activity attribute artifact data, and the plurality of CPU attribute artifact data with a deep machine learning appliance using neutral networks so as to output a forensic dynamic attribute data set for the persistent at least one virtual machine; determining at least one forensic dynamic attribute data set to remove from the forensic dynamic attribute data set and electronically reverting to the stateless at least one virtual machine.
8. The computing platform of claim 7 , wherein the one or more hardware processors are further configured by machine-readable instructions to electronically capture a plurality of digital log attribute artifact data from the persistent at least one virtual machine connected to the virtualization layer.
9. The computing platform of claim 7 , wherein the one or more hardware processors are further configured by machine-readable instructions to electronically capture a plurality of digital log attribute artifact data based on a threshold period of time from the persistent at least one virtual machine connected to the virtualization layer.