Cloud-based method to increase integrity of a next generation antivirus (NGAV) security solution in a virtualized computing environment
A next generation antivirus (NGAV) security solution in a virtualized computing environment includes a security sensor at a virtual machine that runs on a host and a security engine remote from the host. The integrity of the NGAV security solution is increased, by providing a verification as to whether a verdict issued by the security engine has been successfully enforced by the security sensor to prevent execution of malicious code at the virtual machine.
1. A method to operate a security solution in a virtualized computing environment that includes a host and a virtual machine that runs on the host, the method comprising:
identifying, by a security sensor at the virtual machine, an attempt to execute code in the virtual machine;
generating, by the security sensor, a hash value corresponding to the code;
sending, by the security sensor to a security engine remote from the host, the generated hash value and a file map that corresponds to the code;
receiving, by the security sensor from the security engine, a verdict that instructs the security sensor to deny execution of the code based on the security engine having determined from the hash value that the code is malicious;
receiving, by at least one host-level element of the host from the security engine, the verdict and the file map, wherein the at least one host-level element executes in the host and outside of the virtual machine; and
verifying, by the at least one host-level element based on the verdict and on input/output (I/O) activity associated with the file map, whether the security sensor has successfully enforced the verdict to deny execution of the code.
2. The method of claim 1 , wherein the at least one host-level element includes a hypervisor, a host operating system, a sub-process of the hypervisor or host operating system, or a sub-element of the hypervisor or host operating system.
3. The method of claim 1 , wherein verifying whether the security system has successfully enforced the verdict includes determining, by the at least one host-level element, that the security sensor has successfully enforced the verdict, due to the at least one host-level element having detected an absence of the I/O activity.
4. The method of claim 1 , wherein verifying whether the security system has successfully enforced the verdict includes determining, by the at least one host-level element, that the security sensor has failed to enforce the verdict, due to the at least one host-level element having detected a presence of the I/O activity.
5. The method of claim 4 , further comprising:
receiving, by the at least one host-level element from the security engine, at least one remediation instruction along with the verdict and the file map; and
in response to verifying that the security sensor has failed to enforce the verdict, performing, by the at least one host level element, a remediation action specified by the remediation instruction.
6. The method of claim 5 , wherein performing the remediation action includes blocking, by the at least one host-level element, the I/O activity so as to prevent execution of the code.
7. The method of claim 5 , wherein performing the remediation action includes sending, by the at least one host-level element to the security engine, an alert that notifies the security engine of a violation of the verdict.
8. A non-transitory computer-readable medium having instructions stored thereon, which in response to execution by one or more processors, cause the one or more processors to perform or control performance of operations for a security solution in a virtualized computing environment that includes a host and a virtual machine that runs on the host, the operations comprising:
identifying, by a security sensor at the virtual machine, an attempt to execute code in the virtual machine;
generating, by the security sensor, a hash value corresponding to the code;
sending, by the security sensor to a security engine remote from the host, the generated hash value and a file map that corresponds to the code;
receiving, by the security sensor from the security engine, a verdict that instructs the security sensor to deny execution of the code based on the security engine having determined from the hash value that the code is malicious;
receiving, by at least one host-level element of the host from the security engine, the verdict and the file map, wherein the at least one host-level element executes in the host and outside of the virtual machine; and
verifying, by the at least one host-level element based on the verdict and on input/output (I/O) activity associated with the file map, whether the security sensor has successfully enforced the verdict to deny execution of the code.
9. The non-transitory computer-readable medium of claim 8 , wherein the at least one host-level element includes a hypervisor, a host operating system, a sub-process of the hypervisor or host operating system, or a sub-element of the hypervisor or host operating system.
10. The non-transitory computer-readable medium of claim 8 , wherein verifying whether the security system has successfully enforced the verdict includes determining, by the at least one host-level element, that the security sensor has successfully enforced the verdict, due to the at least one host-level element having detected an absence of the I/O activity.
11. The non-transitory computer-readable medium of claim 8 , wherein verifying whether the security system has successfully enforced the verdict includes determining, by the at least one host-level element, that the security sensor has failed to enforce the verdict, due to the at least one host-level element having detected a presence of the I/O activity.
12. The non-transitory computer-readable medium of claim 11 , wherein the operations further comprise:
receiving, by the at least one host-level element from the security engine, at least one remediation instruction along with the verdict and the file map; and
in response to verifying that the security sensor has failed to enforce the verdict, performing, by the at least one host level element, a remediation action specified by the remediation instruction.
13. The non-transitory computer-readable medium of claim 12 , wherein performing the remediation action includes blocking, by the at least one host-level element, the I/O activity so as to prevent execution of the code.
14. The non-transitory computer-readable medium of claim 12 , wherein performing the remediation action includes sending, by the at least one host-level element to the security engine, an alert that notifies the security engine of a violation of the verdict.
15. A host in a virtualized computing environment, the host comprising:
a virtual machine that runs on the host;
a processor; and
a non-transitory computer-readable medium coupled to the processor and having instructions stored thereon, which in response to execution by the processor, cause the processor to perform or control performance of operations for a security solution in the virtualized computing environment, wherein the operations include:
identify, by a security sensor at the virtual machine, an attempt to execute code in the virtual machine;
generate, by the security sensor, a hash value corresponding to the code;
send, by the security sensor to a security engine remote from the host, the generated hash value and a file map that corresponds to the code;
receive, by the security sensor from the security engine, a verdict that instructs the security sensor to deny execution of the code based on the security engine having determined from the hash value that the code is malicious;
receive, by at least one host-level element of the host from the security engine, the verdict and the file map, wherein the at least one host-level element executes in the host and outside of the virtual machine; and
verify by the at least one host-level element based on the verdict and on input/output (I/O) activity associated with the file map, whether the security sensor has successfully enforced the verdict to deny execution of the code.
16. The host of claim 15 , wherein the at least one host-level element includes a hypervisor, a host operating system, a sub-process of the hypervisor or host operating system, or a sub-element of the hypervisor or host operating system.
17. The host of claim 15 , wherein the operation to verify whether the security system has successfully enforced the verdict includes an operation to:
determine, by the at least one host-level element, that the security sensor has successfully enforced the verdict, due to the at least one host-level element having detected an absence of the I/O activity.
18. The host of claim 15 , wherein the operation to verify whether the security system has successfully enforced the verdict includes an operation to:
determine, by the at least one host-level element, that the security sensor has failed to enforce the verdict, due to the at least one host-level element having detected a presence of the I/O activity.
19. The host of claim 18 , wherein the operations further include:
receive, by the at least one host-level element from the security engine, at least one remediation instruction along with the verdict and the file map; and
in response to verification that the security sensor has failed to enforce the verdict, perform, by the at least one host level element, a remediation action specified by the remediation instruction.
20. The host of claim 19 , wherein the operation to perform the remediation action includes an operation to:
block, by the at least one host-level element, the I/O activity so as to prevent execution of the code.
21. The host of claim 19 , wherein the operation to perform the remediation action includes an operation to:
send, by the at least one host-level element to the security engine, an alert that notifies the security engine of a violation of the verdict.