Implementing deferred guest calls in a host-based virtual machine introspection system
Example methods are provided for virtual machine introspection in which a guest monitoring mode (GMM) module monitors the execution of guest calls by an agent that resides in a virtual machine (VM). The GMM module sets a bit in bit mask that corresponds to a guest call that the agent needs to execute, and inserts an invisible breakpoint in the code of the guest call. If the GMM module detects that despite the setting of the bit in the bit mask, the agent does not complete the execution of the code (due to the invisible breakpoint not being triggered), then the GMM module considers this condition as a potential hijack of the VM by malicious code.
1. A method in a virtualized computing environment to implement guest calls in connection with detection of malicious code, wherein the virtualized computing environment includes a guest monitoring mode (GMM) module and an agent in a guest virtual machine (VM), the method comprising:
obtaining, by the GMM module from the agent, information regarding a bit mask and an array, wherein the array is associated with a plurality of guest calls that are executable by the agent in response to setting of corresponding bits in the bit mask by the GMM module;
using, by the GMM module, the obtained information to insert at least one marker into code of at least one guest call of the plurality of guest calls, wherein the at least one marker identifies an execution point in the code;
setting, by the GMM module, a bit in the bit mask that corresponds to the at least one guest call to instruct the agent to execute the at least one guest call;
monitoring, by the GMM module, for completion of execution of the at least one guest call at the execution point identified by the marker; and
in response to a failure to detect the completion of the execution at the execution point, initiating, by the GMM module, a remedial action to address malicious code.
2. The method of claim 1 , further comprising placing, by the GMM module, a write trace on the bit mask and the array to detect an attempt by the malicious code to modify the bit mask and the array.
3. The method of claim 2 , wherein obtaining the information regarding the bit mask and the array includes obtaining at least one address of a memory location where the bit mask and array reside, and wherein placing the write trace includes putting the write trace on the at least one memory location for detection of an attempt by the malicious code to write into the at least one memory location.
4. The method of claim 1 , further comprising:
in response to detection of the completion of the execution at the execution point, clearing, by the GMM module, the corresponding bit in the bit mask that was set.
5. The method of claim 1 , wherein initiating the remedial action includes at least one of: shutting down the guest VM, suspending the guest VM, removing the guest VM from the virtualized computing environment, or sending a report to a management server to enable the management server to alert a system administrator to investigate the failure to detect the completion of the execution.
6. The method of claim 1 , further comprising setting, by the GMM module, a timer having a duration corresponding to an amount of time for the agent to complete execution at the execution point.
7. The method of claim 6 , wherein the failure to detect the completion of the execution at the execution point corresponds to an expiration of the timer.
8. A non-transitory computer-readable medium having instructions stored thereon, which in response to execution by one or more processors, cause the one or more processors to perform or control performance of operations to implement guest calls in connection with detection of malicious code in a virtualized computing environment, wherein the virtualized computing environment includes a guest monitoring mode (GMM) module and an agent in a guest virtual machine (VM), the operations comprising:
obtaining, by the GMM module from the agent, information regarding a bit mask and an array, wherein the array is associated with a plurality of guest calls that are executable by the agent in response to setting of corresponding bits in the bit mask by the GMM module;
using, by the GMM module, the obtained information to insert at least one marker into code of at least one guest call of the plurality of guest calls, wherein the at least one marker identifies an execution point in the code;
setting, by the GMM module, a bit in the bit mask that corresponds to the at least one guest call to instruct the agent to execute the at least one guest call;
monitoring, by the GMM module, for completion of execution of the at least one guest call at the execution point identified by the marker; and
in response to a failure to detect the completion of the execution at the execution point, initiating, by the GMM module, a remedial action to address malicious code.
9. The non-transitory computer-readable medium of claim 8 , wherein the operations further comprise:
placing, by the GMM module, a write trace on the bit mask and the array to detect an attempt by the malicious code to modify the bit mask and the array.
10. The non-transitory computer-readable medium of claim 9 , wherein obtaining the information regarding the bit mask and the array includes obtaining at least one address of a memory location where the bit mask and array reside, and wherein placing the write trace includes putting the write trace on the at least one memory location for detection of an attempt by the malicious code to write into the at least one memory location.
11. The non-transitory computer-readable medium of claim 8 , wherein the operations further comprise:
in response to detection of the completion of the execution at the execution point, clearing, by the GMM module, the corresponding bit in the bit mask that was set.
12. The non-transitory computer-readable medium of claim 8 , wherein initiating the remedial action includes at least one of: shutting down the guest VM, suspending the guest VM, removing the guest VM from the virtualized computing environment, or sending a report to a management server to enable the management server to alert a system administrator to investigate the failure to detect the completion of the execution.
13. The non-transitory computer-readable medium of claim 8 , wherein the operations further comprise:
setting, by the GMM module, a timer having a duration corresponding to an amount of time for the agent to complete execution at the execution point.
14. The non-transitory computer-readable medium of claim 13 , wherein the failure to detect the completion of the execution at the execution point corresponds to an expiration of the timer.
15. A host in a virtualized computing environment, the host comprising:
a processor; and
a non-transitory computer-readable medium coupled to the processor and having stored instructions stored thereon, which in response to execution by the processor, provide a guest monitoring mode (GMM) module and an agent in a guest virtual machine (VM),
wherein the instructions, further in response to execution by the processor, cause the processor to perform or control performance of operations to implement guest calls in connection with detection of malicious code in the virtualized computing environment, and wherein the operations include:
obtain, by the GMM module from the agent, information regarding a bit mask and an array, wherein the array is associated with a plurality of guest calls that are executable by the agent in response to setting of corresponding bits in the bit mask by the GMM module;
use, by the GMM module, the obtained information to insert at least one marker into code of at least one guest call of the plurality of guest calls, wherein the at least one marker identifies an execution point in the code;
setting, by the GMM module, a bit in the bit mask that corresponds to the at least one guest call to instruct the agent to execute the at least one guest call;
monitor, by the GMM module, for completion of execution of the at least one guest call at the execution point identified by the marker; and
in response to a failure to detect the completion of the execution at the execution point, initiate, by the GMM module, a remedial action to address malicious code.
16. The host of claim 15 , wherein the operations further comprise:
place, by the GMM module, a write trace on the bit mask and the array to detect an attempt by the malicious code to modify the bit mask and the array.
17. The host of claim 16 , wherein the operation to obtain the information regarding the bit mask and the array includes an operation to obtain at least one address of a memory location where the bit mask and array reside, and wherein the operation to place the write trace includes an operation to put the write trace on the at least one memory location for detection of an attempt by the malicious code to write into the at least one memory location.
18. The host of claim 15 , wherein the operations further comprise:
in response to detection of the completion of the execution at the execution point, clear, by the GMM module, the corresponding bit in the bit mask that was set.
19. The host of claim 15 , wherein the operation to initiate the remedial action includes an operation to at least one of: shut down the guest VM, suspend the guest VM, remove the guest VM from the virtualized computing environment, or send a report to a management server to enable the management server to alert a system administrator to investigate the failure to detect the completion of the execution.
20. The host of claim 15 , wherein the operations further comprise:
set, by the GMM module, a timer having a duration corresponding to an amount of time for the agent to complete execution at the execution point.
21. The host of claim 20 , wherein the failure to detect the completion of the execution at the execution point corresponds to an expiration of the timer.