Selective virtualization for security threat detection
Selective virtualization of resources is provided, where the resources may be intercepted and services or the resources may be intercepted and redirected. Virtualization logic monitors for one or more activities that are performed in connection with one or more resources and conducted during processing of an object within the virtual machine. The first virtualization logic further selectively virtualizes resources associated with the one or more activities that are initiated during the processing of the object within the virtual machine by at least redirecting a first request of a plurality of requests to a different resource than requesting by a monitored activity of the one or more activities.
1. A non-transitory storage medium including software operating as a hypervisor, comprising:
intercept logic configured to determine (i) whether an incoming request from a source is directed to a resource and (ii) a virtualization scheme to be conducted in connection with the resource, wherein the incoming request includes a system call for a service initiated by a process running at the source;
servicing logic being invoked by the intercept logic, the servicing logic is configured to (i) analyze state information associated with a source of the incoming request, (ii) determine a memory location for placement of data returned in response to the incoming request, and (iii) insert information to change an instruction pointer to reference an end of a function associated with the system call,
wherein operations of the source are temporarily halted in response to receipt of the incoming request.
2. The non-transitory storage medium of claim 1 further comprising:
redirect logic being invoked by the intercept logic, the redirect logic generates response data to the incoming request to cause the source to resume operation.
3. The non-transitory storage medium of claim 1 , wherein the service corresponding to (i) a hardware-related service or (ii) a process management service.
4. The non-transitory storage medium of claim 1 further comprising management logic configured to signal the source, being a virtual machine, to halt execution in response to the intercept logic receiving the incoming request and pass operation control to the intercept logic.
5. The non-transitory storage medium of claim 2 , wherein the virtualization scheme includes either a first virtualization scheme handled by the servicing logic or a second virtualization scheme handled by the redirect logic.
6. The non-transitory storage medium of claim 5 , wherein the incoming request includes the system call for the service initiated by the process running in an user mode of a virtual machine operating as the source.
7. The non-transitory storage medium of claim 5 , wherein the redirect logic configured to generate the response data by at least modifying the system call and returns the modified system call to the virtual machine to resume operations in accordance with the second virtualization scheme.
8. The non-transitory storage medium of claim 1 , wherein the intercept logic is further configured to (i) access configuration data to determine whether the request is associated with a prescribed interception point and (ii) assess a usage pattern that identifies the virtualization scheme to be conducted to the resource being (a) an intercept and service virtualization scheme conducted by the intercept logic and the servicing logic or (b) an interrupt and redirect virtualization scheme conducted by the intercept logic and the redirect logic.
9. The non-transitory storage medium of claim 8 , wherein, during the intercept and redirection virtualization scheme, the redirect logic substitutes a stored file path with an alternative file path before causing the source to resume operation.
10. A hypervisor to support virtualization for detecting security threats, comprising:
first logic configured to intercept and service requests associated with a first subset of activities; and
second logic configured to intercept and redirect requests associated with a second subset of activities,
wherein (A) the first logic is configured to (i) intercept a first request of the requests, (ii) analyze state information associated with a virtual machine operating as a source of the first request, (iii) determine a memory location for placement of data returned in response to the first request, and (iv) alter a pointer stored within the memory location to reference an end of a function that initiated the first request or (B) the second logic is configured to (i) intercept the first request, (ii) modify the first request, and (iii) return the modified first request to the virtual machine operating as the source of the first request, the modified first request including information to cause the virtual machine to resume operations after the virtual machine is temporarily halted after the second logic receives the first request.
11. The hypervisor of claim 10 , wherein the pointer is an instruction pointer stored within the memory location to reference an end of a function that initiated the first request.
12. The hypervisor of claim 10 , wherein the first request intercepted by the second logic is a system call.
13. A threat detection platform that conducts selective virtualization of resources to enhance threat detection, comprising:
processing logic; and
a virtual machine adapted for receive signaling from the processing logic during virtual processing of a suspicious object, the virtual machine comprises
intercept logic configured to determine (i) whether an incoming request from a source is directed to a resource and (ii) a virtualization scheme to be conducted in connection with the resource, wherein the incoming request includes a system call for a service initiated by a process running at the source,
servicing logic being invoked by the intercept logic, the servicing logic is configured to (i) analyze state information associated with a source of the incoming request, (ii) determine a memory location for placement of data returned in response to the incoming request, and (iii) insert information to change an instruction pointer to reference an end of a function associated with the incoming request, and
redirect logic being invoked by the intercept logic, the redirect logic generates response data to the incoming request to cause the source to resume operation,
wherein operations of the source are temporarily halted in response to receipt of the incoming request.
14. The threat detection platform of claim 13 , wherein the incoming request includes the system call for the service initiated by the process running in an user mode of a virtual machine operating as the source.
15. The threat detection platform of claim 13 , wherein the virtualization scheme further includes a second virtualization scheme handled by the redirect logic.
16. The threat detection platform of claim 15 , wherein the function is associated with the system call.
17. The threat detection platform of claim 15 , wherein the second virtualization scheme comprises the redirect logic generates the response data by at least modifying the system call and returns the modified system call to the virtual machine to resume operations.
18. The threat detection platform of claim 13 , wherein the intercept logic is further configured to (i) access configuration data to determine whether the request is associated with a prescribed interception point and (ii) assess a usage pattern that identifies a virtualization scheme to be conducted to the resource being (a) an intercept and service virtualization scheme conducted by the intercept logic and the servicing logic or (b) an interrupt and redirect virtualization scheme conducted by the intercept logic and the redirect logic.
19. The threat detection platform of claim 18 , wherein, during the intercept and redirection virtualization scheme, the redirect logic substitutes a stored file path with an alternative file path before causing the source to resume operation.