Malware protection for virtual machines
A computer-implemented method at a data management system comprises: receiving, at a storage appliance from a server hosting a virtual machine, a write made to the virtual machine; computing, at the storage appliance, a fingerprint of the transmitted write; comparing, at the storage appliance, the computed fingerprint to malware fingerprints in a malware catalog; repeating the computing and comparing; and disabling the virtual machine if a number of matches from the comparing breaches a predetermined threshold over a predetermined amount of time.
1. A data management system, comprising:
a storage appliance configured to store a snapshot of a virtual machine; and
one or more processors in communication with the storage appliance, the one or more processors configured to perform operations including:
receiving, at the storage appliance from a server hosting the virtual machine, a write made to the virtual machine;
computing, at the storage appliance, a fingerprint of the received write;
comparing, at the storage appliance, the computed fingerprint to malware fingerprints in a malware catalog while the virtual machine continues to receive writes;
repeating the computing and comparing for the continued received writes; and
disabling the virtual machine if a number of matches from the comparing breaches a predetermined threshold over a predetermined amount of time, the predetermined threshold greater than one.
2. The system of claim 1 , wherein the operations further include restoring the virtual machine using the snapshot stored in the storage appliance to a state before the predetermined threshold was breached.
3. The system of claim 1 , wherein the operations further include blocking writes from a source of the matches.
4. The system of claim 1 , wherein the operations further include generating the malware catalog including generating fingerprints of binaries and compressed binaries of known malware.
5. The system of claim 4 , wherein the fingerprints are computed at 4 kilobytes aligned offsets generated using SHA256.
6. The system of claim 1 , wherein the operations further include repeatedly generating snapshots of the virtual machine over time.
7. A computer-implemented method at a data management system, the method comprising:
receiving, at a storage appliance from a server hosting a virtual machine, a write made to the virtual machine;
computing, at the storage appliance, a fingerprint of the received write;
comparing, at the storage appliance, the computed fingerprint to malware fingerprints in a malware catalog while the virtual machine continues to receive writes;
repeating the computing and comparing for the continued received writes;
maintaining a log of the continued received writes; and
reversing the writes to revert the virtual machine per the maintained log if a number of matches from the comparing breaches a predetermined threshold over a predetermined amount of time.
8. The method of claim 7 , further comprising restoring the virtual machine using a snapshot stored in the storage appliance to a state before the predetermined threshold was breached.
9. The method of claim 7 , further comprising blocking writes from a source of the matches.
10. The method of claim 7 , further comprising generating the malware catalog including generating fingerprints of binaries and compressed binaries of known malware.
11. The method of claim 10 , wherein the fingerprints are computed at 4 kilobytes aligned offsets generated using SHA256.
12. The method of claim 7 , further comprising repeatedly generating snapshots of the virtual machine over time.
13. A non-transitory, machine-readable medium storing instructions which, when read by a storage appliance, cause the storage appliance to perform operations comprising, at least:
receiving, at the storage appliance from a server hosting a virtual machine, a write made to the virtual machine;
computing, at the storage appliance, a fingerprint of the received write;
comparing, at the storage appliance, the computed fingerprint to malware fingerprints in a malware catalog while the virtual machine continues to receive writes;
repeating the computing and comparing for the continued received writes; and
disabling the virtual machine if a number of matches from the comparing breaches a predetermined threshold over a predetermined amount of time, the predetermined threshold greater than one.
14. The machine-readable medium of claim 13 , wherein the operations further include restoring the virtual machine using a snapshot stored in the storage appliance to a state before the predetermined threshold was breached.
15. The machine-readable medium of claim 13 , wherein the operations further include blocking writes from a source of the matches.
16. The machine-readable medium of claim 13 , wherein the operations further include generating the malware catalog including generating fingerprints of binaries and compressed binaries of known malware.
17. The machine-readable medium of claim 16 , wherein the fingerprints are computed 4 kilobytes aligned offsets generated using SHA256.
18. The machine-readable medium of claim 13 , wherein the operations further include repeatedly generating snapshots of the virtual machine over time.