System memory context determination for integrity monitoring and related techniques

1. A computer-implemented method comprising:

determining, by a hypervisor, that an operating system (OS) is started in a host virtualization system, wherein the started OS comprises a boot fingerprint comprising an allocation of one or more host physical memory (HPM) pages;

examining, by the hypervisor, contents of at least one system memory page of the one or more HPM pages to determine a type of OS that is loaded on the at least one system memory page of the one or more HPM pages, wherein the examination comprises analyzing information loaded on the one or more HPM pages when the OS is started and based on the boot fingerprint, wherein the boot fingerprint identifies various operating systems based on the one or more HPM pages storing particular aspects of the OS in specific addresses; and

assigning, by the hypervisor and subsequent to the examination, at least one tag to the at least one system memory page of the one or more HPM pages based on the determined type of OS and the examination of the contents of the at least one system memory page of the one or more HPM pages,

wherein the at least one tag indicates characteristics of the contents stored in the at least one system memory page of the one or more HPM pages including characteristics of data stored in an extended page table (EPT), and wherein the at least one tag allows for context-aware monitoring of the at least one system memory page.

2. The computer-implemented method of claim 1 , wherein the at least one tag indicates a type of data stored in the at least one system memory page.

3. The computer-implemented method of claim 1 , wherein the at least one tag indicates that the at least one system memory page is a critical system memory page.

4. The computer-implemented method of claim 3 , further comprising:

hashing the contents of the at least one system memory page to compute a hash value; and

comparing the computed hash value to a corresponding golden hash value to determine the integrity of the least one system memory page.

5. A system comprising:

one or more non-transitory machine-readable mediums configured to store instructions; and

one or more processors configured to execute the instructions stored on the one or more non-transitory machine-readable mediums, wherein execution of the instructions causes the one or more processors to:

determine, by a hypervisor, that an operating system (OS) is started in a host virtualization system, wherein the started OS comprises a boot fingerprint comprising an allocation of one or more host physical memory (HPM) pages;

examine, by the hypervisor, contents of at least one system memory page of the one or more HPM pages to determine a type of OS that is loaded on the at least one system memory page of the one or more HPM pages, wherein the examination comprises analyzing information loaded on the one or more HPM pages when the OS is started and based on the boot fingerprint, wherein the boot fingerprint identifies various operating systems based on the one or more HPM pages storing particular aspects of the OS in specific addresses; and

assign, by the hypervisor and subsequent to the examination, at least one tag to the at least one system memory page of the one or more HPM pages based on the determined type of OS and the examination of the contents of the at least one system memory page of the one or more HPM pages, wherein the at least one tag indicates characteristics of the contents stored in the at least one system memory page of the one or more HPM pages including characteristics of data stored in an extended page table (EPT), and wherein the at least one tag allows for context-aware monitoring of the at least one system memory page.

6. The system of claim 5 , wherein the at least one tag indicates a type of data stored in the at least one system memory page.

7. The system of claim 5 , wherein the at least one tag indicates that the at least one system memory page is a critical system memory page.

8. The system of claim 7 , wherein execution of the instructions causes the one or more processors to:

hash the contents of the at least one system memory page to compute a hash value; and

compare the computed hash value to a corresponding golden hash value to determine the integrity of the least one system memory page.

9. A computer program product including one or more non-transitory machine readable mediums encoded with instructions that when executed by one or more processors cause a process to be carried out, the process comprising:

determining, by a hypervisor, that an operating system (OS) is started in a host virtualization system, wherein the started OS comprises a boot fingerprint comprising an allocation of one or more host physical memory (HPM) pages;

examining, by the hypervisor, contents of at least one system memory page of the one or more HPM pages to determine a type of OS that is loaded on the at least one system memory page of the one or more HPM pages, wherein the examination comprises analyzing information loaded on the one or more HPM pages when the OS is started and based on the boot fingerprint, wherein the boot fingerprint identifies various operating systems based on the one or more HPM pages storing particular aspects of the OS in specific addresses; and

assigning, by the hypervisor and subsequent to the examination, at least one tag to the at least one system memory page of the one or more HPM pages based on the determined type of OS and the examination of the contents of the at least one system memory page of the one or more HPM pages,

wherein the at least one tag indicates characteristics of the contents stored in the at least one system memory page of the one or more HPM pages including characteristics of data stored in an extended page table (EPT), and wherein the at least one tag allows for context-aware monitoring of the at least one system memory page.

10. The computer program product of claim 9 , wherein the at least one tag indicates a type of data stored in the at least one system memory page.

11. The computer program product of claim 9 , wherein the at least one tag indicates that the at least one system memory page is a critical system memory page.

12. The computer program product of claim 11 , the process further comprising:

hashing the contents of the at least one system memory page to compute a hash value; and

comparing the computed hash value to a corresponding golden hash value to determine the integrity of the least one system memory page.