Verification of trusted threat-aware visualization layer

Description

BACKGROUND
Technical Field

The disclosure herein relates to virtualization systems and, more specifically, to a verification of a trusted threat-aware microvisor of a virtualization system.

Background Information

A virtual machine monitor (VMM) or hypervisor may be a hardware or software entity configured to create and run a software implementation of a computing platform or machine, i.e., a virtual machine. The hypervisor may be implemented as a type 1 VMM executing directly on native hardware of the computing platform, or a type 2 VMM executing within an operating system environment of the platform. The hypervisor may be further deployed in a virtualization system that fully simulates (virtualizes) physical (hardware) resources of the computing platform. Such a full virtualization system may support execution of a plurality of operating system instances inside a plurality of virtual machines, wherein the operating system instances share the hardware resources of the platform. The hypervisor of the full virtualization system may manage such sharing by hiding the hardware resources of the computing platform from users (e.g., application programs) executing on each operating system instance and, instead, providing an abstract, virtual computing platform. For example, a hardware resource, such as a network interface card (NIC), may be shared by enabling each virtual machine (and its operating system instance) to access a virtualized instance of the resource, i.e., a virtual NIC.

A virtualization system may include a hypervisor that creates other virtual machines, each of which executes an independent instance of an operating system. Malicious code may be prevented from compromising resources of the system through the use of policy enforcement and containment analysis that isolates execution of the code within a virtual machine to block or inhibit its execution within the system (i.e., outside of the virtual machine). However, the hypervisor itself may be a target of malicious code and, hence, succumb to infiltration or alteration by malicious code due to an unforeseen security flaw or vulnerability. Therefore, there is a need for a malware resistant virtualization system that is highly immune to exploits of unknown security vulnerabilities.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and further advantages of the embodiments herein may be better understood by referring to the following description in conjunction with the accompanying drawings in which like reference numerals indicate identically or functionally similar elements, of which:

FIG. 1 is a block diagram of a network environment that may be advantageously used with one or more embodiments described herein;

FIG. 2 is a block diagram of a node that may be advantageously used with one or more embodiments described herein;

FIG. 3 is a block diagram of a trusted, threat-aware microvisor that may be advantageously used with one or more embodiments described herein;

FIG. 4 is a block diagram of a micro-virtualization architecture including a trusted computing base (TCB) that may be advantageously used with one or more embodiments described herein;

FIG. 5 is a block diagram illustrating a chain of loading that may be advantageously used with one or more embodiments described herein;

FIG. 6 is a block diagram of an enhanced verification arrangement that may be advantageously used with one or more embodiments described herein;

FIG. 7 is an example procedure for enhanced verification that may be advantageously used with one or more embodiments described herein; and

FIG. 8 is a block diagram of a deployment of the trusted, threat-aware microvisor in a virtualization system that may be advantageously used with one or more embodiments described herein.

DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

The embodiments herein provide a trusted threat-aware microvisor that may be deployed in a virtualization system configured to facilitate run-time security analysis, including exploit and malware detection as well as threat intelligence collection, associated with one or more operating system processes executing on a node of a network environment. The trusted threat-aware microvisor (hereinafter “microvisor”) may be embodied as a light-weight module disposed or layered beneath (underlying) an operating system kernel executing on the node to control privileges (i.e., access permissions or capabilities) to kernel resources, such as one or more central processing units (CPUs), network interfaces, memory, and/or devices, of the node. Illustratively, the microvisor may be configured to control access to one or more of the resources in response to a request by an operating system process to access the resource. As such, the microvisor may operate, inter alia, as a micro-hypervisor (“microvisor”).

In an embodiment, the microvisor is a module of a trusted computing base (TCB) that also includes a root task module (hereinafter “root task”) configured to cooperate with the microvisor to load (create) and initialize one or more other modules executing on the CPU of the node. The root task may further cooperate with the microvisor to allocate one or more of the kernel resources to those other modules. In this context, allocation of the kernel resources may include creation of (maximal) capabilities that specify an extent to which each module may access its allocated kernel resource(s). An example of such a module is a type 0 virtual machine monitor (VMM 0) configured to expose the kernel resources of the node to the operating system kernel.

As a trusted module of the TCB, the microvisor is illustratively configured to enforce a security policy of the TCB that, e.g., prevents alteration of a state related to security of the microvisor by a module (e.g., software entity) of or external to an environment in which the microvisor operates, i.e., the TCB. For example, an exemplary security policy may provide, “modules of the TCB shall be immutable,” which may be implemented as a security property of the microvisor, an example of which is no module of the TCB modifies a state related to security of the microvisor without authorization. In an embodiment, the security policy of the TCB may be implemented by a plurality of security properties of the microvisor. That is, the exemplary security policy may be also implemented (i.e., enforced) by another security property of the microvisor, another example of which is no module external to the TCB modifies a state related to security of the microvisor without authorization. As such, one or more security properties of the microvisor may operate concurrently to enforce the security policy of the TCB.

Illustratively, the microvisor may manifest (i.e., demonstrate) the security property in a manner that enforces the security policy. Accordingly, verification of the microvisor to demonstrate the security property necessarily enforces the security policy, i.e., the microvisor may be trusted by demonstrating the security property. As used herein, trusted (or trustedness) denotes a predetermined level of confidence that the security property is demonstrated by the microvisor. The predetermined level of confidence, in turn, is based on an assurance (i.e., grounds) that the microvisor demonstrates the security property. Therefore, manifestation denotes a demonstrated implementation that assurance is provided regarding the implementation based on an evaluation assurance level, i.e., the more extensive the evaluation, the greater the assurance level.

To support (and maintain) such trustedness, a chain of loading may be configured to securely launch the microvisor as a first software entity loaded into the memory of the node during a boot process. In an embodiment, a unified extensible firmware interface (UEFI) implementation may be extended to provide the chain of loading to securely launch the microvisor for deployment on the node. Illustratively, the UEFI may then load the root task of the TCB prior to loading any other software entity, such as VMM 0 or the operating system kernel. The chain of loading provided by the UEFI may be further configured to authenticate the microvisor code prior to launching.

In an embodiment, trustedness of the microvisor may be verified by subjecting the TCB (i.e., microvisor and root task) to enhanced verification analysis prior to deployment on the node. Enhanced verification may be configured to ensure that the TCB conforms to an operational model with an appropriate level of confidence over an appropriate range of activity (e.g., inputs, outputs, and operational states). The operational model may then be configured to analyze conformance of the microvisor to the security property, i.e., to determine whether the microvisor demonstrates the security property. A combination of conformance by the microvisor to the operational model and to the security property provides assurance (i.e., grounds) for the level of confidence and, thus, verifies trustedness. For example, trustedness (i.e., a predetermined level of confidence in manifestation of the security property) of the microvisor may be verified (i.e., confidence elevated) by demonstrating that an instruction issued by a module external to the TCB and having one or more arguments configured to alter an expected behavior or state of the microvisor related to the security property results in a violation (i.e., generation of a capability violation) such that the instruction is rejected (reply with error code) or ignored and prevented from execution by the microvisor.

I. Description

FIG. 1 is a block diagram of a network environment 100 that may be advantageously used with one or more embodiments described herein. The network environment 100 illustratively includes a plurality of computer networks organized as a public network 120, such as the Internet, and a private network 130, such an organization or enterprise network. The networks 120, 130 illustratively include a plurality of network links and segments connected to a plurality of nodes 200. The network links and segments may embody local area networks (LANs) 110 and wide area networks (WANs) 150, including wireless networks, interconnected by intermediate nodes 2001, such as network switches or routers, to form an internetwork of nodes. The LANs 110 may, in turn, interconnect end nodes 200E embodied as endpoints. In an embodiment, the endpoints may illustratively include, e.g., client/server desktop computers, laptop/notebook computers, process controllers, medical devices, data acquisition devices, mobile devices, such as smartphones and tablet computers, and/or any other intelligent electronic device having network connectivity that may be configured to implement a virtualization system. The nodes 200 illustratively communicate by exchanging packets or messages (i.e., network traffic) according to a predefined set of protocols, such as the Transmission Control Protocol/Internet Protocol (TCP/IP); however, it should be noted that other protocols, such as the HyperText Transfer Protocol (HTTP), may be advantageously used with the embodiments herein. In the case of private network 130, the intermediate node 2001 may include a firewall or other network device configured to limit or block certain network traffic in an attempt to protect the endpoints from unauthorized users. Unfortunately, such attempts often fail to protect the endpoints, which may be compromised nonetheless.

FIG. 2 is a block diagram of a node 200, e.g., an end node 200E or intermediate node 2001, that may be advantageously used with one or more embodiments described herein. The node 200 illustratively includes one or more central processing unit (CPUs) 212, a memory 220, one or more network interfaces 214 and one or more devices 216 connected by a system interconnect 218, such as a bus. The devices 216 may include a human interface device (such as a display and associated (graphical) user interface, keyboard, trackball or mouse), storage devices, and/or other types of input/output (I/O) or peripheral devices. Each network interface 214 may contain the mechanical, electrical and signaling circuitry needed to connect the node to the network 120, 130 thereby to facilitate communication over the network. To that end, the network interface 214 may be configured to transmit and/or receive messages using a variety of communication protocols including, inter alia, TCP/IP and HTTP.

The memory 220 may include a plurality of locations that are addressable by the CPU(s) 212 and the network interface(s) 214 for storing software program code (including application programs) and data structures associated with the embodiments described herein. The CPU 212 may include processing elements or logic adapted to execute the software program code, such as trusted threat-aware microvisor 300, and manipulate the data structures, such as system table 260 and process table 270. Exemplary CPUs may include families of instruction set architectures based on the ×86 CPU from Intel Corporation of Santa Clara, Calif. and the ×64 CPU from Advanced Micro Devices of Sunnyvale, Calif.

An operating system kernel 230, portions of which are typically resident in memory 220 and executed by the CPU, functionally organizes the node by, inter alia, invoking operations in support of the application programs executing on the node. A suitable operating system kernel 230 may include the Windows® series of operating systems from Microsoft Corp of Redmond, Wash., the MAC OS® and IOS® series of operating systems from Apple Inc. of Cupertino, Calif. and versions of the Android™ operating system from Google, Inc. of Mountain View, Calif., among others. Suitable application programs may include Adobe Reader® from Adobe Systems Inc. of San Jose, Calif. and Microsoft Word from Microsoft Corp of Redmond, Wash. Illustratively, the application programs may be implemented via user mode processes 240 of the kernel 230. As used herein, a process (e.g., a user mode process) is an instance of software program code (e.g., an application program) executing in the operating system that may be separated (decomposed) into one or more of threads, wherein each thread is a sequence of execution within the process.

It will be apparent to those skilled in the art that other types of processing elements and memory, including various computer-readable media, may be used to store and execute program instructions pertaining to the embodiments described herein. Also, while the embodiments herein are described in terms of software program code, processes, and computer, e.g., application, programs stored in memory, alternative embodiments also include the code/processes/programs being embodied as modules consisting of hardware, software, firmware, or combinations thereof.

A. Trusted Threat-Aware Microvisor

The embodiments herein provide a trusted, threat-aware microvisor that may be deployed in a virtualization system configured to facilitate run-time security analysis, including exploit and malware detection as well as threat intelligence collection, associated with one or more operating system processes executing on the node 200 of the network environment 100. FIG. 3 is a block diagram of the trusted, threat-aware microvisor 300 that may be advantageously used with one or more embodiments described herein. The trusted threat-aware microvisor (hereinafter “microvisor”) may be embodied as a light-weight module disposed or layered beneath (underlying, i.e., directly on native hardware) the operating system kernel 230 executing on the node to virtualize the hardware and control privileges (i.e., access control permissions or capabilities) to kernel (e.g., hardware) resources of the node 200 that are typically controlled by the operating system kernel. That is, the microvisor may be implemented in an operationally efficient (i.e., light-weight) manner that maintains user experience (i.e., little performance degradation) at the node. Illustratively, the kernel resources may include (physical) CPU(s) 212, memory 220, network interface(s) 214 and devices 216. The microvisor may be configured to control access to one or more of the resources in response to a request by an operating system process to access the resource. As such, the microvisor may operate, inter alia, as a micro-hypervisor (“microvisor”).

As a light-weight module, the microvisor may provide a virtualization layer having less functionality than a typical hypervisor. Accordingly, the microvisor may cooperate with a unique virtual machine monitor (VMM), i.e., a type 0 VMM, to provide additional virtualization functionality in an operationally and resource efficient manner. Unlike a type 1 or type 2 VMM (hypervisor), the type 0 VMM (VMM 0) does not fully virtualize the kernel (hardware) resources of the node and supports execution of only one entire operating system/instance inside one virtual machine, i.e., VM 0. VMM 0 may thus instantiate VM 0 as a container for the operating system kernel 230 and its kernel resources. In an embodiment, VMM 0 may instantiate VM 0 as a module having instrumentation logic 360A directed to determination of an exploit and malware in any suspicious operating system process (kernel or user mode). Illustratively, VMM 0 is a pass-through module configured to expose the kernel resources of the node (as controlled by microvisor 300) to the operating system kernel 230. VMM 0 may also expose resources such as virtual CPUs (threads), wherein there is one-to-one mapping between the number of physical CPUs and the number of virtual CPUs that VMM 0 exposes to the operating system kernel 230. To that end, VMM 0 may enable communication between the operating system kernel (i.e., VM 0) and the microvisor over privileged interfaces 315a and 310a.

The VMM 0 may include software program code (e.g., executable machine code) in the form of instrumentation logic 350 (including decision logic) configured to analyze one or more interception points originated by one or more operating system processes to invoke the services, e.g., accesses to the kernel resources, of the operating system kernel 230. As used herein, an interception point is a point in an instruction stream where control passes to (e.g., is intercepted by) either the microvisor, VMM 0 or another virtual machine. An interception point may thus include, inter alia, a memory access request, a function call or a system call. For example in response to an interception point, VMM 0 may assume control over the operating system kernel 230 to enable monitoring of activity (including examination of a state) of the process to determine its suspiciousness and to enable detection of exploits or other potentially malicious behavior of malware. Suspiciousness may thus denote anomalous behavior of a process or its interception point (e.g., system call) that is not expected during run-time and, therefore, may indicate a certain probability of being an exploit or malware. Illustratively, the instrumentation logic 350 may include a classifier (not shown) that determines whether a process is suspicious (and categorize the activity) using pre-defined anomalous behaviors (monitored activity) of verified exploits and malware. Examples of a threat-aware microvisor, a VMM 0 and a micro-virtual machine are described in U.S. patent application Ser. No. 14/229,533 titled Threat-Aware Microvisor by Osman et al, filed Mar. 28, 2014.

An exploit may thus be construed broadly as information (e.g., executable code, data, one or more commands) that attempts to take advantage of a computer program or system vulnerability in order to execute malware. Typically, a vulnerability may be a coding error or artifact of a computer program that allows an attacker to alter legitimate control flow during processing of the computer program by an electronic device and, thus, causes the electronic device to experience undesirable or unexpected behaviors. The undesired or unexpected behaviors may include a communication-based or execution-based anomaly which, for example, could (1) alter the functionality of the electronic device executing application software in a malicious manner; (2) alter the functionality of the electronic device executing the application software without any malicious intent; and/or (3) provide unwanted functionality which may be generally acceptable in another context. To illustrate, a computer program may be considered a state machine where all valid states (and transitions between states) are managed and defined by the program, in which case an exploit may be viewed as seeking to alter one or more of the states (or transitions) from those defined by the program. Malware may be construed broadly as computer code that is executed by an exploit to harm or co-opt operation of an electronic device or misappropriate, modify or delete data. Conventionally, malware may often be designed with malicious intent.

As described herein, a system call provides an interception point at which a switch in privilege levels occurs in the operating system, i.e., from a privilege level of the user mode process to a privilege level of the operating system kernel. VMM 0 may intercept the system call and examine a state of the process issuing (sending) the call. The instrumentation logic 350 of VMM 0 may analyze the system call to determine whether the call is suspicious and, if so, instantiate (spawn) one or more “micro” virtual machines (VMs) equipped with monitoring functions that cooperate with the microvisor to detect anomalous behavior which may be used in determining an exploit. As used herein, the term “micro” VM denotes a virtual machine serving as a container that is restricted to a process (as opposed to VM 0 which is spawned as a container for the entire operating system). Such spawning of a micro-VM may result in creation of an instance of another module (i.e., micro-VM N) that is substantially similar to VM 0, but with different (e.g., additional) instrumentation logic 360N illustratively directed to determination of an exploit in the suspicious process by, e.g., monitoring its behavior.

In an embodiment, the spawned micro-VM illustratively encapsulates an operating system process, such as user mode process 240. The process may include one or more threads that may be encapsulated by the spawned micro-VM. In another embodiment, two or more related processes (e.g., sharing a user mode resource, such as memory) may be encapsulated by the micro-VM. In terms of execution, operation of the process is controlled and synchronized by the operating system kernel 230; however, in terms of access to kernel resources, operation of the encapsulated process is controlled by VMM 0. Notably, there is no sharing of kernel resources among spawned micro-VMs. That is, the resources appear to be isolated within each spawned micro-VM such that each respective encapsulated process appears to have exclusive control of the resources. In other words, access to kernel resources is synchronized among the micro-VMs and VM 0 by VMM 0 rather than virtually shared. Accordingly, VMM 0 may contain computer executable instructions executed by the CPU 212 to perform operations that initialize and implement the instrumentation logic 350, as well as operations that spawn, configure and control VM 0 and any of a plurality of micro-VMs (including instrumentation logic 360A-N). Similar to VM 0, each micro-VM may be configured to communicate with the microvisor (via VMM 0) over privileged interfaces 315n and 310n. Notably, the privileged interfaces 310a-n and 315a-n may be embodied as a set of defined hyper-calls, as described further herein.

In an embodiment, the microvisor 300 may be organized to include a plurality of protection domains (e.g., PD 0-N) illustratively bound to VM 0 and one or more micro-VMs, respectively. As used herein, a protection domain is a container for various data structures, such as execution contexts, scheduling contexts, and capabilities associated with the kernel resources accessible by an operating system process. Illustratively, the protection domain may function at a granularity of an operating system process (e.g., a user mode process 240) and, thus, is a representation of the process. Accordingly, the microvisor may provide a protection domain for the process and its run-time threads executing in the operating system. The main protection domain (PD0) of the microvisor controls all of the kernel resources available to the operating system kernel 230 (and, hence, the user mode process 240) of VM 0 via VMM 0 and, to that end, may be associated with the services provided to the user mode process by the kernel 230, such as information in the process table 270. The spawned micro-VM (e.g., micro-VM N) is illustratively associated with (bound to) a copy of PD 0 (e.g., PD N) which, in turn, may be bound to the process, wherein such binding may occur through memory context switching.

In response to a decision to spawn the micro-VM N, VMM 0 may issue a hyper-call over interface 310a to the microvisor requesting creation of the protection domain PD N. Upon receiving the hyper-call, the microvisor 300 may copy (i.e., “clone”) the data structures (e.g., execution contexts, scheduling contexts and capabilities) of PD 0 to create PD N for the micro-VM N, wherein PD N has essentially the same structure as PD 0 except for the capabilities 340n associated with the kernel resources. As used herein, a capability is a protection (access control permission) associated with a kernel resource. For example, the capabilities 340n for PD N may limit or restrict access to one or more of the kernel resources as instructed through one or more hyper-calls from, e.g., VMM 0 and/or micro-VM N over interface 310a,n to the microvisor. Accordingly, the microvisor 300 may contain computer executable instructions executed by the CPU 212 to perform operations that initialize, clone and configure the protection domains. Each protection domain PD 0-N may include one or more execution contexts 320a-n, each of which is tightly linked to a respective scheduling context 330a-n. Each execution context 320a-n further interacts with the capabilities 340a-n, whose contents specify access control permissions (i.e., protecting access) to the kernel resources. Illustratively, the capabilities may be organized as a list of access permissions for each kernel resource, although those of skill in the art will understand that other data structures may be used to organize the access permissions.

As used herein, an execution context 320 is illustratively a representation of a thread (associated with an operating system process) and, to that end, defines a state of the thread for execution on CPU 212. In an embodiment, the execution context may include inter alia (i) contents of CPU registers, (ii) pointers/values on a stack, (iii) a program counter, and/or (iv) allocation of memory via, e.g., memory pages. The execution context 320 is thus a static view of the state of thread and, therefore, its associated process. Accordingly, the thread executes within the protection domain associated with the operating system process of which the thread is a part. For the thread to execute on a CPU 212 (e.g., as a virtual CPU), its execution context 320 is tightly linked to a scheduling context 330, which may be configured to provide information for scheduling the execution context 320 for execution on the CPU 212. Illustratively, the scheduling context information may include a priority and a quantum time for execution of its linked execution context on CPU 212.

In an embodiment, the capabilities 340 may be organized as a set of access control permissions to the kernel resources to which the thread may request access. Each time the execution context 320 of a thread requests access to a kernel resource, the capabilities 340 are examined. There is illustratively one set of capabilities 340 for each protection domain, such that access to kernel resources by each execution context 320 (i.e., each thread of an execution context) of a protection domain may be defined by the set of capabilities 340. For example, physical addresses of pages of memory 220 (resulting from mappings of virtual addresses to physical addresses) may have associated access permissions (e.g., read, write, read-write) within the protection domain. To enable an execution context 320 to access a kernel resource, such as a memory page, the physical address of the page may have a capability 340 that defines how the execution context 320 may reference that page. Illustratively, the capabilities may be examined by hardware (e.g., a hardware page fault upon a memory access violation) or by program code. As described herein, violation of a capability in a protection domain may be an interception point, which returns control to the VM (e.g., VM 0 or micro-VM N) bound to the protection domain.

Advantageously, the microvisor 300 may be organized as separate protection domain containers for the operating system kernel 230 (PD 0) and one or more operating system processes (PD N) to facilitate further monitoring and understanding of behaviors of the process and its threads. Such organization of the microvisor also enforces separation between the protection domains to control the activity of the monitored process. Moreover, the microvisor 300 may enforce access to the kernel resources through the use of variously configured capabilities 340 of the separate protection domains. Unlike previous virtualization systems, separation of the protection domains to control access to kernel resources at a process granularity enables detection of anomalous behavior of an exploit. That is, in addition to enforcing access to kernel resources, the microvisor enables analysis of the operation of a process within a spawned micro-VM to detect exploits or other malicious code threats that may constitute malware.

Assume a user mode process 240 has one or more threads that run on one or more CPUs 212. Each thread has an associated execution context 320 that defines its state. When executing on a CPU 212, the thread may attempt to access a resource (a memory page). VMM 0 may instruct the microvisor 300 to configure the access permission to the memory page according to a definition of the capability within the protection domain bound to the process executing the thread. Assume further that the capability specifies that a protection domain (e.g., PD 0) can have only read-only access to the memory page. If the CPU 212 attempts to write to that memory page, i.e., a write access, a trap (e.g., an exception, such as a page fault or general protection fault) may be generated by the CPU and the microvisor 300 may report the trap (via an exception handler) to VMM 0. VMM 0 may decide that such write access should be allowed and instructs the microvisor to allow the access. Alternatively, VMM 0 may decide that such write access warrants further analysis and spawns micro-VM N. VMM 0 may then issue a hyper-call to the microvisor 300 requesting cloning of PD 0 to create PD N (for the spawned micro-VM N) and further requesting a different set of capabilities for PD N to further monitor the process 240 (i.e., the capabilities of the protection domain bound to micro-VM N may be altered). In an embodiment, the different set of capabilities may be specified by instrumentation logic 360N of the spawned micro-VM N. The instrumentation logic 360N may specify the different set of capabilities (via one or more hyper-calls over interfaces 315n, 310n) in order to receive further reports of any violations of capabilities (e.g., traps) and then specify the type of action to take in response to those reports.

For example, the instrumentation logic 350 of VMM 0 may specify a set of capabilities for PD 0 (via a hyper-call) that is different from the capabilities specified for PD N by the instrumentation logic 360N of micro-VM N (via a different hyper-call). Illustratively, the capabilities of PD N may be more restricted than those of PD 0 in order to capture behavior not otherwise monitored by PD 0. Nevertheless, PD 0 may have temporarily elevated protection requiring limited capabilities due to, e.g., a malicious rootkit executing in the operating system kernel 230. In an embodiment, the different set of capabilities requested by micro-VM N for the cloned PD N may pertain to certain kernel resources, such as memory regions (as opposed to memory pages of the regions). Here, the capabilities may not be configured to define access permissions at the granularity of memory pages (e.g., 4K bytes) because of the substantial memory resources (i.e., page table entries) needed to accommodate sufficient pages to cover large memory regions. Accordingly, in an embodiment, a region of memory may be associated with certain permissions (read-only, write-only) as defined by the capabilities and micro-VM N may subsequently “fine-grain” (e.g., enlarge or shrink) that memory region to enable read or write only permissions to memory pages within the region.

B. Trusted Computing Base (TCB)

In an embodiment, the microvisor may be stored in memory as a module of a trusted computing base that also includes a root task module (hereinafter “root task”) configured to cooperate with the microvisor to create (i.e., load) one or more other modules executing on the CPU of the node. FIG. 4 is a block diagram of a micro-virtualization architecture 400 including the trusted computing base (TCB) 410 that may be advantageously used with one or more embodiments described herein. Illustratively, the micro-virtualization architecture 400 may organize the memory 220 as a user space 402 and a kernel space 404. The microvisor 300 may be disposed as a relatively small code base (e.g., approximately 9000-10,000 lines of code) that underlies the operating system kernel 230 and executes in the kernel space 404 of the architecture 400 to control access to the kernel resources for any operating system process (kernel or user mode). Notably, the microvisor 300 executes at the highest privilege level of the hardware (CPU) thereby to virtualize access to the kernel resources of the node in a light-weight manner.

The user mode processes 240 and operating system kernel 230 may execute in the user space 402 of the micro-virtualization architecture 400, although it will be understood to those skilled in the art that one or more of the user mode processes may execute in another address space defined by the operating system kernel. Illustratively, the operating system kernel 230 may execute under control of the microvisor 300 at a privilege level (i.e., a logical privilege level) lower than a highest privilege level of the microvisor, but at a higher CPU privilege level than that of the user mode processes 240. In addition, VMM 0 and its spawned VMs (e.g., VM 0 and micro-VM N) may execute in user space 402 of the architecture 400 as processes having a relatively larger code base (e.g., approximately 20,000-30,000 lines of code) than the microvisor, primarily due to the instrumentation logic 350, 360. As a type 0 virtual machine monitor, VMM 0 (and its spawned VM 0 and micro-VMs) may execute at the highest (logical) privilege level of the microvisor 300. That is, VMM 0 (and its spawned VM 0 and micro-VMs) may operate under control of the microvisor at the highest microvisor privilege level, but may not directly operate at the highest CPU (hardware) privilege level.

In an embodiment, the root task 420 may be disposed as a relatively small code base (e.g., approximately 1000 lines of code) that overlays the microvisor 300 (i.e., underlies VMM 0) and executes in the user space 402 of the architecture 400. Through cooperation (e.g., communication) with the microvisor, the root task 420 may also initialize (i.e., initially configure) the loaded modules executing in the user space 402. To that end, the root task 420 may execute at the highest (absolute) privilege level of the microvisor. Illustratively, the root task 420 may communicate with the microvisor 300 to allocate the kernel resources to the loaded user space modules. In this context, allocation of the kernel resources may include creation of, e.g., maximal capabilities that specify an extent to which each module (such as, e.g., VMM 0) may access its allocated resource(s). For example, the root task 420 may communicate with the microvisor 300 through instructions to allocate memory and/or CPU resource(s) to VMM 0, and to create capabilities that specify maximal permissions allocated to VMM 0 when attempting to access (use) the resource(s). Such instructions may be provided over the privileged interface 310 embodied as one or more hyper-calls. Notably, the root task 420 is the only (software or hardware) entity that can instruct the microvisor with respect to initial configuration of such resources.

In an embodiment, the root task 420 may be implemented as a “non-long lived” process that terminates after creation and initial configuration of the user space processes (modules). The non-long lived nature of the root task is depicted by dash lining of the root task 420 in FIG. 4. Illustratively, the root task 420 is the first user space process to boot (appear) during power-up and initialization of the node, including loading and initial configuration of the user space modules and their associated capabilities; the root task then terminates (disappears). The root task 420 may thereafter be re-instantiated (reappear) during a reboot process, which may be invoked in response to an administrative task, e.g. update of VMM 0. Notably, the root task 420 may only appear and operate on the node in response to a (re)boot process, thereby enhancing security of the TCB 410 by restricting the ability to (re)initialize the microvisor 300 after deployment on the node 200.

As a trusted module of the TCB, the microvisor 300 is illustratively configured to enforce a security policy of the TCB that, e.g., prevents (obviates) alteration or corruption of a state related to security of the microvisor by a module (e.g., software entity) of or external to an environment in which the microvisor 300 operates, i.e., the TCB 410. For example, an exemplary security policy may provide, “modules of the TCB shall be immutable,” which may be implemented as a security property of the microvisor, an example of which is no module of the TCB modifies a state related to security of the microvisor without authorization. In an embodiment, the security policy of the TCB 410 may be implemented by a plurality of security properties of the microvisor 300. That is, the exemplary security policy may be also implemented (i.e., enforced) by another security property of the microvisor, another example of which is no module external to the TCB modifies a state related to security of the microvisor without authorization. As such, one or more security properties of the microvisor may operate concurrently to enforce the security policy of the TCB.

Illustratively, the microvisor 300 may manifest (i.e., demonstrate) the security property in a manner that enforces the security policy. Accordingly, verification of the microvisor to demonstrate the security property necessarily enforces the security policy, i.e., the microvisor 300 may be trusted by demonstrating the security property. Trusted (or trustedness) may therefore denote a predetermined level of confidence that the microvisor demonstrates the security property (i.e., the security property is a property of the microvisor). It should be noted that trustedness may be extended to other security properties of the microvisor, as appropriate. Furthermore, trustedness may denote a predetermined level of confidence that is appropriate for a particular use or deployment of the microvisor 300 (and TCB 410). The predetermined level of confidence, in turn, is based on an assurance (i.e., grounds) that the microvisor demonstrates the security property. Therefore, manifestation denotes a demonstrated implementation that assurance is provided regarding the implementation based on an evaluation assurance level, i.e., the more extensive the evaluation, the greater the assurance level. Evaluation assurance levels for security are well-known and described in Common Criteria for Information Technology Security Evaluation Part 3: Security Assurance Components, September 2012, Ver 3.1 (CCMB-2012-09-003). For example, evaluation assurance level 7 includes formal design verification and test as confirmed independently (i.e., by a third party).

In an embodiment, trustedness may include both (i) manifestation of the security property in the microvisor code (e.g., no inherent security flaw) as a static attribute, as well as (ii) manifestation of the security property while the code executes on the CPU (e.g., no alteration by an exploit) as a dynamic attribute. That is, trustedness may include manifestation of the security property as both static and dynamic attributes. As such, secure loading of trusted code contributes to overall trustedness, i.e., a predetermined level of confidence that the security property manifests in the microvisor 300 as deployed on the node. To support (and maintain) such trustedness, a chain of loading may be configured to securely launch the microvisor 300 as a first software entity loaded into memory 220 of node 200 during a boot process. FIG. 5 is a block diagram illustrating a chain of loading 500 that may be advantageously used with one or more embodiments described herein. Illustratively, a unified extensible firmware interface (UEFI 510) implementation (i.e., a Basic Input Output System, BIOS) may be extended to provide the chain of loading 500 to securely launch the microvisor 300 for deployment on the node. After loading the microvisor 300, the UEFI 510 may load the root task 420 of the TCB 410 prior to loading any other software entity, such as VMM 0 or the operating system kernel 230. The chain of loading 500 provided by the UEFI 510 may be further configured to authenticate the microvisor code prior to launching. It should be noted that the UEFI is stored in firmware and, thus, is not to be construed as the first software entity loaded during a boot process.

In an embodiment, loading of the microvisor 300 and root task 420 is performed by a UEFI loader, e.g., boot manager 520, in accordance with an “early loading” procedure. The early loading procedure is illustratively provided by the hardware platform, e.g., including the UEFI 510, as part of an initialization (power-up) and boot sequence. Broadly stated, a power on self-test (POST) procedure may be invoked and executed by the CPU 212 in response to powering-on of the node 200. Firmware of the UEFI 510 may then be loaded to initialize the hardware (including the kernel resources) of the node prior to booting of software program code, such as UEFI application programs. The firmware may then invoke the boot manager 520 to launch one or more of the UEFI application programs, e.g., from a storage device. Illustratively, the first UEFI application program launched by the boot manager is the microvisor 300 and the second UEFI application program launched immediately thereafter is the root task 420. The boot manager 520 may thus control the boot order and location of the microvisor 300 and root task 420 by, e.g., configuring the memory 220, constructing any necessary data structures (such as system table 260 for run-time and boot services) and configuring interrupt interfaces (e.g., storage devices).

C. Enhanced Verification

In an embodiment, trustedness of the microvisor 300 may be verified by subjecting the TCB 410 (i.e., the microvisor and root task) to enhanced verification analysis prior to deployment on the node. Illustratively, the enhanced verification is performed in a computing environment (e.g., including processing and memory resources to accommodate execution of the software programs constituting the enhanced verification system described herein) that are separate and apart from the network environment deploying the trusted microvisor. Enhanced verification may be configured to ensure that the TCB 410 conforms to an operational model (e.g., constructed with key elements of the code base) with an appropriate level of confidence over an appropriate range of activity (e.g., inputs, outputs, and operational states). The operational model may be a sufficient specification of the behavior of the microvisor as modeled in a typed Lambda calculus, e.g., a pure functional programming language such as Haskell and OCaml. For example, the operational model may include sufficient detail to specify the hyper-calls (e.g., how hyper-call parameters are encoded in binary form) and to describe, e.g., in abstract logical terms, the effect of each hyper-call. It should be noted that the operational model is not an implementation of the microvisor (e.g., ‘C++’ source code), but rather a functional specification of desired effects (e.g., effects of each hyper-call) on the behavior of the microvisor. The operational model may be rendered executable by generating suitable functional programming language code (e.g., Haskell and OCaml) from a theorem prover (e.g., Coq or Isabelle). For example, a Haskell to ‘C’ translator may be used to generate C or C++ code, which is then compiled to machine code. Alternatively, machine code may be generated directly (i.e., compiled) from the functional programming language code, e.g., OCaml. In addition, interpreted functional programming languages (e.g., Haskell byte-codes) also may be used. It should be noted that the executable operational model may be used for automated consistency verification (e.g., compliance testing) between the operational model and the TCB, as described herein.

The theorem prover may provide an environment to verify the security property as a theorem with respect to (against) the operational model (i.e., logically prove the security property in a model domain). Illustratively, the security property may be entered into the theorem prover as a thereom (e.g., trustedness of the microvisor) to be verified against the operational model using, e.g., Hoare logic. The theorem prover may then be used to determine whether the operational model demonstrates the security property (as both static and dynamic attributes) and, thus, the security policy. In response, the operational model may be modified when the security property is not demonstrated. For example, failure to demonstrate the security property may be static (e.g., a coding error) or dynamic (e.g., deficient of protection, such as insufficient checking of invalid hyper-call parameters). In other words, the operational model (i.e., functional specification) of the microvisor 300 may be iteratively modified until the security property is demonstrated. In this manner assurance is provided that the TCB (e.g., microvisor) demonstrates the security property, thus yielding the predetermined level of confidence that the TCB 410 manifests the security policy. Notably, assurance of the consistency between the operational model and the code base of the TCB is also used to achieve a sufficient level of confidence (i.e., trustedness) that the TCB demonstrates the security policy. Therefore, the operational model may serve as a convenient and efficient proxy to verify both correctness and manifestation of the security property.

Illustratively, formal verification of the TCB involves: (i) mathematical and logical verification (e.g., by humans) of the operational model against the security property (i.e., manifestation of the security property); (ii) development of the code base (e.g., by humans) to comply with the operational model (e.g., iteratively modify the code base to achieve manifestation of the security property); (iii) comprehensive compliance testing (preferably by automation) to ensure consistency between the code base and the operational model; and (iv) verification of the hardware/firmware of the node. For example, a 10,000 lines of code software stack (e.g., TCB 410 including the microvisor 300 and root task 420) may require as many as hundreds of man years of effort to perform the unwieldy and complex human intensive task of formal verification (without the hardware verification indicated in (iv) above) on the TCB, where a majority of such effort would be directed to the assurance of consistency between the operational model and the TCB. Such verification may require services of highly-educated and skilled software developers, e.g., having PhDs and post doctorate degrees. In sum, the assurance of consistency between the operational model and the TCB may be lengthy and complex. Therefore, it is desirable to provide an efficient method for assuring consistency between the operational model and the TCB (i.e., as indicated in (iii) above) based on a prescribed level confidence, i.e., a predetermined level of confidence sufficient to assure trustedness.

As noted, trustedness may be defined in terms of the predetermined level of confidence that is appropriate for a particular deployment of the microvisor. Such a level of confidence may be quantified based on the operational model. Indeed, a definition of trustedness may be rooted in commercial value of the microvisor. That is, a microvisor with a higher level of confidence with respect to manifesting the security property than that of another virtualization system has a greater commercial value. Approaching a 100% level of (i.e., complete) confidence requires formal verification (including comprehensive compliance testing) of the entire TCB, which may be too extensive and, thus, impractical for many deployments. Therefore, a practical solution may mandate a predetermined level of confidence (e.g., not less than 90%) with associated risks (e.g., vulnerabilities) that is appropriate for a particular deployment. It should be noted that the predetermined level of confidence with respect to the security property may be prescribed with respect to code that has been proven correct, i.e., code that has been compliance tested and determined to be sufficiently correct for product commercialization. As such, the predetermined level of confidence (i.e., assurance) in trustedness may be increased (and the associated risk reduced) with additional compliance testing. That is, assurance in trustedness may monotonically increase with an amount of compliance testing.

In an embodiment, the microvisor 300 may be configured to enable rapid compliance testing in accordance with an enhanced verification procedure that dramatically reduces the man years required to achieve near formal (i.e., greater than 90% confidence) verification of the TCB. As noted, the enhanced verification may be performed in a computing environment separate and apart from the network environment deploying the trusted microvisor. FIG. 6 is a block diagram of the enhanced verification arrangement that may be advantageously used with one or more embodiments described herein. The enhanced verification arrangement 600 may include a model domain 602 which provides the ability to verify (i.e., logically prove) the security property 610 against the operational model 630. The verification arrangement 600 may also include a real domain 652 that executes the microvisor 300 as the actual object (i.e., binary code) sought to be assured of trustedness. Assurance of trustedness is provided when (i) the security property 610 is demonstrated within the model domain 602 and (ii) the real domain 652 sufficiently conforms to the model domain 602.

The enhanced verification arrangement 600 may further include a “mode” function 635 of the microvisor 300 that captures a state 650b of the microvisor to ensure consistency with a corresponding state 650a of the operational model 630. Illustratively, the mode function 635 may be software code (i.e., a state descriptor) configured to capture (e.g., via a dump operation) the state 650b of the microvisor (e.g., at a point in time) and to express that state in a manner that can be compared with extracted state 650a from the operational model 630. Illustratively, the mode function implements a function to provide a view or recording of the state (e.g., dump state operation), which dumps the state 650b of the microvisor 300 after a number of instructions of the microvisor have executed. A checkpoint communication 660a between a debugger 640 (e.g., a control module) in the real domain 652 and the operational model 630 may be used to initiate capture of the states 650a,b respectively for comparison. Alternatively, a checkpoint communication 660b between the operational model 630 in the model domain 602 and the mode function 635 of the microvisor in the real domain 652 may be used to initiate capture of the states 650a,b respectively for comparison. The checkpoint and state comparison may occur automatically (i.e., without human intervention) thereby to reduce an otherwise labor intensive process. In an embodiment, the operational model 630 may be further configured to analyze conformance to the security property 610. Such conformance between the operational model 630 and the microvisor 300 may be assured or verified (i.e., to the predetermined level of confidence) when a sufficient number of states (related to security) match between the microvisor and the operational model. In other words, conformance to the security property 610 is verified, e.g., for the predetermined level of confidence, when there is sufficient test coverage between the model domain 602 and the real domain 652.

For example, trustedness (i.e., a predetermined level of confidence in manifestation of the security property) of the microvisor 300 may be verified (i.e., confidence elevated) by demonstrating that an instruction issued by a module (e.g., VMM 0) external to the TCB and having one or more arguments configured to alter an expected behavior or state of the microvisor related to the security property results in a violation (i.e., generation of a capability violation) such that the instruction is rejected (reply with error code) or ignored and prevented from execution by the microvisor. To that end, binary code of the microvisor 300 may be tested to execute an input (e.g., an operation manifested as a hyper-call issued by VMM 0 to access a kernel resource) with a resulting output (e.g., denial of access to the resources manifested as a capability violation) and an associated operational state 650b. Illustratively, the operational state may be expressed as a microvisor dump object provided by the state descriptor. The operational model 630 may be similarly tested to execute the inputs with resulting outputs and associated operational states 650a (e.g., expressed as model dump objects). The microvisor and model dump objects may then be compared, e.g. using conventional software testing methodologies that include an automated testing environment to verify consistency. Illustratively, such automated, on-demand state-based consistency verification (e.g., compliance testing) between the operational model 630 and the TCB (i.e., trusted microvisor 300) enables comparison 670 of respective operational states so as to verify that the TCB demonstrates the security property 610.

FIG. 7 is an example procedure for enhanced verification that may be advantageously used with one or more embodiments described herein. The procedure 700 starts at step 710 and continues to step 720 where the security property is iteratively verified in the model domain by the theorem prover (i.e., logical verification that the operational model manifests the security property). At step 725, a determination is made as to whether the security property fails. If so, the microvisor is deemed untrusted at step 775 and the procedure completes at step 790. However, if the security property does not fail (i.e., the operational model progresses in manifesting the security property), the operational model may be generated from the theorem prover at step 728 to render an executable operational model (e.g., a binary compiled from generated OCaml code, or Haskell bytes-codes).

A state dump of the operational model (i.e., the executable operational model) is initiated in the model domain at step 730 and, at step 740, a corresponding state dump of the microvisor is initiated in the real domain. At step 750, the state dumps of the operational model and microvisor are compared and, at step 760, a determination is made as to whether the states match. If not, the microvisor is deemed untrusted at step 775 and the procedure completes at step 790. However, if the states match, then a determination is made (step 770) as to whether a predetermined number of states (related to the security property) have been found to match. If not, the procedure returns to step 730 where a state (i.e., a next state) dump of the operational model iteratively continues. If the predetermined number of states have been found to match, then the predetermined number of matched states correspond to a predetermined level of confidence that the security property is implemented by the microvisor (step 780), thereby rendering the microvisor a trusted microvisor. The procedure then completes at step 790.

D. Deployment of Trusted Microvisor in Virtualization System

FIG. 8 is a block diagram of deployment of the trusted threat-aware microvisor in a virtualization system that may be advantageously used with one or more embodiments described herein. Illustratively, the virtualization system 800 may be enhanced to provide an exploit and malware detection system (e.g., using static and dynamic analysis) executing on the node 200 of network environment 100. The microvisor 300 may be deployed as a module of the virtualization system 800 that executes in the kernel space 402 of the micro-virtualization architecture 400. The virtualization system also includes VMM 0 and its spawned VMs (e.g., VM 0 and micro-VM 1), as well as operating system kernel 230 and user mode processes 240, each of which executes in user space 402 of the architecture. It should be noted that the virtualization system 800 depicts the deployment of the microvisor after creation and initial configuration of the user space processes (modules) and, thus, does not include the root task 420.

As noted, the microvisor 300 executes at the highest privilege level of the CPU, while VMM 0 and the spawned VMs execute at the highest (logical) privilege level of the microvisor. In contrast, the operating system kernel 230 executes under control of the microvisor at a privilege level (i.e., a logical privilege level) lower than a highest privilege level of the microvisor, but at a higher CPU privilege level than that of the user mode processes 240. Privileges are logical constructs illustratively defined by operations that may be performed (executed) at the various privilege levels of the micro-virtualization architecture. That is, operations that may be executed by the microvisor (at the highest CPU privilege level) may not be executed by VMM 0 at its privilege level. Similarly, operations that may be executed by VMM 0 (at the highest microvisor privilege level) may not be executed by the operating system kernel 230 (at a lower microvisor privilege level). As an example of the latter, VMM 0 may execute an operation (e.g., via a hyper-call) to instruct the microvisor to create (clone) a protection domain, whereas the operating system kernel may not execute such an operation. Operations of the various privilege levels are expressed and enforced through the use of capabilities 340 of the microvisor 300, i.e., privileges are bound to capabilities as configured at the microvisor. Illustratively, instrumentation logic 350, 360 may configure the capabilities 340 of the protection domains within the microvisor to enable analysis of interception points. For example, assume access to a memory page is configured (via capabilities) as read-only for a protection domain and a process attempts to write to that memory page. Such a memory access request is an example of an interception point, which may cause (trigger) a violation of a capability (e.g., a trap) and which may result in analysis of the process and the request by, e.g., switching between the privilege levels of the architecture.

As used herein, a hyper-call is generally similar to a system call, with a primary difference that the request for service is directed to the microvisor instead of the operating system kernel. Specifically, the micro-virtualization architecture provides a small, limited set of hyper-calls, each having limited arguments, as a way to switch between privilege levels of the architecture. Whereas a system call may enable switching between a user mode level (e.g., of user mode process 240) and a kernel level (e.g., of operating system kernel 230) of the operating system, a hyper-call enables switching from user space 402 to kernel space 404 of the micro-virtualization architecture 400.

In an embodiment, the hyper-calls are implemented as inter process communication (IPC) messages exposed (available) to VMM 0, VM 0 and any spawned micro-VMs. The hyper-calls are generally originated by VMM 0 and directed to the microvisor 300 over privileged interface 310, although VM0 and the micro-VMs may also originate one or more hyper-calls (IPC messages) directed to the microvisor over privileged interface 315. However, the hyper-calls originated by VM 0 and the micro-VMs may be more restricted than those originated by VMM 0. For example, micro-VM 1 may attempt to issue a hyper-call that instructs the microvisor to create (clone) a protection domain, but the capabilities 340b of protection domain PD 1 (which is bound to micro-VM 1) may limit or preclude successful execution of such a hyper-call. In contrast, the hyper-calls are not available to the operating system kernel 230 and, as such, the kernel may not issue such calls to the microvisor. Notably, a hyper-call (e.g., IPC message) may be generated when the encapsulated process 240 in the micro-VM attempts to access a kernel resource.

The operating system kernel 230 may be configured to include an operating system (OS) specific VMM extension 820 adapted to communicate with VMM 0. The OS specific VMM extension 820 illustratively contains executable machine code in the form of logic configured to provide an interface to VMM 0 (and, in particular, the instrumentation logic 350) that allows introspection (examination and/or interception) of contents of internal structures of the operating system kernel 230. Such introspection may involve examination of data structures of the operating system kernel in a manner that obviates duplication of (i.e., without duplicating) those structures. Accordingly, the OS specific VMM extension 820 may contain computer executable instructions executed by the CPU 212 to perform operations that implement communication with, and introspection by, VMM 0. For example, assume it is desirable to acquire identifications (IDs) of the user mode processes 240 running in the operating system and that the process IDs are stored in a data structure, e.g., the process table 270, of the operating system kernel 230. Instead of having to duplicate that data structure and its contents, the VMM 0 can instruct the OS specific VMM extension 820 to examine the process table 270 and provide the ID of a process 240. Illustratively, VMM 0 may communicate with the operating system kernel 230 (i.e., the OS specific VMM extension 820) over a defined application programming interface (API) 825.

As noted, the execution context 320 of a thread (e.g., of a user mode process 240) executing on a CPU 212 (e.g., as a virtual CPU) is tightly linked to a scheduling context 330. In an embodiment, the scheduling context 330 may include information defining a priority of execution for its linked execution context, e.g., as implemented by one or more queues 860. Once linked to its execution context 320, the scheduling context 330 may be placed (inserted) onto an appropriate queue 860 having a defined priority of execution. A global scheduler 850 of the microvisor may cooperate with the scheduling context 330 to schedule the context for execution on a CPU 212. Multiple execution contexts 320 may be bound to a same CPU 212 or multiple CPUs 212. Illustratively, the global scheduler 850 manages the queues 860 of scheduling contexts thereby to manage the CPUs 212 in an orderly manner. To that end, the global scheduler 850 may examine the queues 860 and determine which scheduling context 330 (execution context 320) may run on which CPU 212. The global scheduler 850 may then dispatch the scheduling context 330 to the appropriate CPU 212 for execution of its linked execution context 320.

In an embodiment, the microvisor 300 may be configured to perform scheduling of execution contexts 320 and verification of operational requests by the execution contexts with respect to capabilities 340. If there is a violation of the capabilities for a protection domain, a trap (e.g., an exception, such as a page fault or general protection fault) may be generated by the CPU (or other hardware) and serviced by an exception handler 830 of the microvisor. For example, if a process 240 attempts to access a resource to which the capability specifies it does not have permission, the CPU may generate the trap and the exception handler may report the violation to, e.g., VMM 0 for analysis. In addition, the microvisor may provide VMM 0 with state information associated with the execution context 320 executing at the time of the trap. The capability violation may trigger invocation of the instrumentation logic 350 of VMM 0 to determine whether the process is suspicious or even an exploit and, if so, an appropriate course of action. Depending on the seriousness of the violation, VMM 0 may decide to, e.g., change a register value, issue a capability change or spawn a micro-VM (micro-VM 1). VMM 0 may then provide instructions to the microvisor (PD 0) as to a course of action.

Illustratively, the instrumentation logic 350 of VMM 0 may include monitoring logic configured to monitor and collect capability violations in response to one or more interception points thereby to infer an exploit. Inference of an exploit may also be realized through sequences of interception points wherein, for example, a system call followed by another system call having certain parameters may lead to an inference that the process sending the calls is an exploit. The interception point thus provides an opportunity for VMM 0 to perform “light-weight” analysis (e.g., static analysis) to evaluate a state of the process in order to detect a possible exploit without requiring any policy enforcement. That is, policy enforcement is not necessary to detect the process as an exploit. VMM 0 may then decide to perform dynamic analysis by spawning a micro-VM and configure the capabilities of its protection domain to enable deeper monitoring and analysis (e.g., through interception points and capability violations for dynamic analysis) in order to determine whether the process is an exploit or contains malware. Notably, the analysis may also classify the process as a type of exploit (e.g., a stack overflow) and may even identify the exploit or malware, e.g., using pre-defined anomalous behaviors (monitored activity) of verified exploits and malware. As a result, the invocation of instrumentation and monitoring logic of VMM 0 and its spawned VMs in response to interception points originated by operating system processes and capability violations generated by the microvisor advantageously enhance the virtualization system described herein to provide an exploit and malware detection system configured for run-time security analysis (i.e., dynamic analysis) of the operating system processes executing on the node.

VMM 0 may also log the state of the monitored process within system logger 870. In an embodiment, the state of the process may be realized through the contents of the execution context 330 (e.g., CPU registers, stack, program counter, and/or allocation of memory) executing at the time of each capability violation. In addition, the state of the process may be realized through correlation of various activities or behavior of the monitored process. The logged state of the process may thereafter be exported from the system logger 870 to another node 200 of the network environment 100 by, e.g., forwarding the state as one or more IPC messages through VMM 0 (VM 0) and OS specific VMM extension 820 and onto a network protocol stack of the operating system kernel. The network protocol stack may then format the messages as one or more packets for transmission over the network 120, 130. Determination of the presence of an exploit or malware may also be reported to the graphical display (e.g., on the user interface) and as a notification to an administrator (e.g., email and wireless text message).

While there have been shown and described illustrative embodiments for providing a trusted threat-aware microvisor for deployment in a virtualization system executing on a node of a network environment, it is to be understood that various other adaptations and modifications may be made within the spirit and scope of the embodiments herein. For example, embodiments have been shown and described herein with relation to the root task embodied as a non-long lived process that terminates after creation and configuration of the user space modules. However, the embodiments in their broader sense are not so limited and may, in fact, allow for the root task to remain as a dormant (sleeping) process until an administrative task is requested, at which time the root task may be invoked (awoken).

In addition, embodiments have been shown and described herein with relation to a chain of loading configured to securely launch the microvisor as the first software entity loaded on the node during a boot process. Again, the embodiments in their broader sense are not so limited and may allow for a chain of loading configured to ensure that any previously-loaded software entities (e.g., Windows® operating system kernel) are authentic (thus presumed adequately trusted) prior to launching of the trusted microvisor. In such an embodiment, loading of the microvisor 300 and root task 420 may be performed in accordance with a “late loading” procedure (i.e., loaded later than code loaded directly by the UEFI). Illustratively, the late loading procedure may shift the privilege level of the previously-loaded software entities, such that those software entities operate as processes controlled by the trusted microvisor. That is, the trusted microvisor subsumes the highest privilege level of the hardware (e.g., CPU) and delegates a privilege level (i.e., a logical privilege level) lower than a highest privilege level of the microvisor to the previously-loaded software. An example of a late loader is Deep Defender from Intel Corporation, which also provides protection (e.g., isolation of memory space and code base) enforcement.

The foregoing description has been directed to specific embodiments. It will be apparent, however, that other variations and modifications may be made to the described embodiments, with the attainment of some or all of their advantages. For instance, it is expressly contemplated that the components and/or elements described herein can be implemented as software encoded on a tangible (non-transitory) computer-readable medium (e.g., disks and/or CDs) having program instructions executing on a computer, hardware, firmware, or a combination thereof. Accordingly this description is to be taken only by way of example and not to otherwise limit the scope of the embodiments herein. Therefore, it is the object of the appended claims to cover all such variations and modifications as come within the true spirit and scope of the embodiments herein.

Claims

1. A method comprising: collecting state information associated with an operational model associated with a code base of a virtualization layer, the virtualization layer being configured to execute on a node including a processor and an operation system, to control access permissions to resources of the node;collecting state information associated with the code base of the virtualization layer, the code base of the virtualization layer includes a function to enable capture of the state information associated with the code base of the virtualization layer by at least initiating a state dump of the code base;iteratively comparing state information of the operational model and the state information of the code base of the virtualization layer; andcontinuing iterative comparison of the state information of the operational model and the state information of the code base of the virtualization layer until a predetermined number of states match, wherein the predetermined number of matched states signifies a level of confidence of a security property being implemented by the code base of the virtualization layer.
2. The method of claim 1 wherein conformance of the code base of the virtualization layer to a security policy represented by one or more security properties including the security property is verified when the predetermined number of states of the operational model resulting from a state dump of the operational model match states of the code base of the virtualization layer resulting from the state dump of the code base.
3. The method claim 2, wherein the virtualization layer enforces the security policy of the code base and a trustedness of the virtualization layer is based on the level of confidence of the security property being implemented by the code base of the virtualization layer.
4. The method of claim 2, wherein a determination of the security property being implemented by the code base of the virtualization layer identifies compliance by the virtualization layer to a security policy represented at least in part by the security property.
5. The method of claim 1, wherein the function to enable capture of each respective state of the code base of the virtualization layer after a number of instructions of the code base of the virtualization layer have executed.
6. The method of claim 1, wherein the code base of the virtualization layer is configured for rapid compliance testing by the function of the code base of the virtualization layer initiating the state dump of the code base of the virtualization layer being in communication with the operational model.
7. The method of claim 1, wherein trustedness of the code base of the virtualization layer is defined in terms of manifesting security properties including manifesting a first security property in the code base of the virtualization layer, the first security property operating as a static attribute representing no inherent security flaw in the code base of the virtualization layer.
8. The method of claim 1, wherein the trustedness of the code base of the virtualization layer is further defined in terms of manifesting a second security property while the code base of the virtualization layer executes, the second security property operating as a dynamic attribute representing no alteration of the code base of the virtualization layer by an exploit.
9. The method of claim 1 further comprising: maintaining trustedness of the code base of the virtualization layer by at least loading the virtualization layer for execution where the virtualization layer is executed as a first software module loaded into a memory of the node during a boot process.
10. The method of claim 9, wherein the trustedness of the code base of the virtualization layer is further maintained by at least loading a root task of a trusted computing base for execution prior to any other software module other than the virtualization layer, the trusted computing base includes the virtualization layer and the root task.
11. The method of claim 1, wherein the virtualization layer is a light-weight module disposed or layered beneath the operating system executing on the node to control privileges to the resources.
12. The method of claim 1, wherein the collecting of the state information associated with the operational model is conducted by at least initiating a state dump of the operational model.
13. A system comprising: a central processing unit (CPU) to execute a code base of a virtualization layer operating to control access permissions to resources of the system;a memory configured to store the code base of the virtualization layer as a computing base, the computing base is associated with one or more security properties including a first security property verified by the system configured to: collect state information associated with an operational model by at least initiating a state dump of the state information associated with the operational model;collect state information associated with the code base of the virtualization layer by at least initiating a state dump of the state information associated with the code base of the virtualization layer;iteratively compare the state information associated with the operational model and the state information associated with the code base of the virtualization layer; andcontinue iterative comparison of states being part of the state information associated with the operational model and states being part of state information associated with the code base of the virtualization layer until a predetermined number of the states match, wherein the predetermined number of matched states correspond to a predetermined level of confidence that the first security property is implemented by the code base of the virtualization layer.
14. The system of claim 13, wherein the operational model specifies a behavior of the code base of the virtualization layer as modeled in a functional programming language.
15. The system of claim 13, wherein the initiating of the state dump of the state information associated with operational model and the initiating of the corresponding state dump of the state information associated with the code base of the virtualization layer occur without human intervention.
16. The system of claim 13, wherein conformance of the code base of the virtualization layer to the first security property is verified when the predetermined number of the states of the operational model match the states of the code base of the virtualization layer.
17. A non-transitory computer readable medium including program instructions for execution on a processor of a node configured to be communicatively coupled a network, the program instructions configured to: collect state information associated with an operational model for modules of a code base;collect state information associated with the modules, wherein the code base comprises a function configured to initiate a state dump of the modules being in communication with the operational model to collect the state information;iteratively compare the state information associated with the operational model and the state information associate with the modules; andcontinue iterative comparison of the state information associated with the operational model and the state information associated with the modules until a predetermined number of the states match, wherein the predetermined number of matched states signifies a level of confidence of a security property being implemented by the code base and a compliance with a security policy represented at least in part by the security property.
18. The non-transitory computer readable medium of claim 17, wherein the operational model specifies a behavior of the modules and is created in a functional programming language.
19. The non-transitory computer readable medium of claim 17, wherein the code base includes a code base of a virtualization layer that is configured to execute on the node to control access permissions to resources of the node.
20. The non-transitory computer readable medium of claim 19, wherein trustedness of the code base of the virtualization layer increases monotonically with an amount of compliance testing.
21. The non-transitory computer readable medium of claim 19 wherein trustedness of the code base of the virtualization layer is defined in terms of manifesting security properties including manifesting a first security property in the code base of the virtualization layer operating as a static attribute representing no inherent security flaw in the code base of the virtualization layer and manifesting a second security property while the code base of the virtualization layer executes thereby operating as a dynamic attribute representing no alteration of the code base of the virtualization layer by an exploit.
22. The non-transitory computer readable medium of claim 17, wherein the program instructions are configured to initiate the state dump of the operational model to collect the state information associated with the operational model and initiate a corresponding state dump of the modules without human intervention.
23. The non-transitory computer readable medium of claim 17, wherein a theorem prover, being a portion of the program instructions, is configured to verify a plurality of security properties of the operational model, including the security property, using Hoare logic.

RELATED APPLICATION

The application is a continuation of U.S. patent application Ser. No. 14/615,798 filed Feb. 6, 2015, now U.S. Pat. No. 10,002,252 issued Jun. 19, 2018, which claims priority to U.S. Provisional Patent Application No. 62/019,725, filed on Jul. 1, 2014, the contents of which are incorporated herein by reference.

US Referenced Citations (721)

Number	Name	Date	Kind
4292580	Ott et al.	Sep 1981	A
5175732	Hendel et al.	Dec 1992	A
5319776	Hile et al.	Jun 1994	A
5440723	Arnold et al.	Aug 1995	A
5490249	Miller	Feb 1996	A
5657473	Killean et al.	Aug 1997	A
5802277	Cowlard	Sep 1998	A
5842002	Schnurer et al.	Nov 1998	A
5960170	Chen et al.	Sep 1999	A
5978917	Chi	Nov 1999	A
5983348	Ji	Nov 1999	A
6088803	Tso et al.	Jul 2000	A
6092194	Touboul	Jul 2000	A
6094677	Capek et al.	Jul 2000	A
6108799	Boulay et al.	Aug 2000	A
6154844	Touboul et al.	Nov 2000	A
6269330	Cidon et al.	Jul 2001	B1
6272641	Ji	Aug 2001	B1
6279113	Vaidya	Aug 2001	B1
6298445	Shostack et al.	Oct 2001	B1
6357008	Nachenberg	Mar 2002	B1
6424627	Sorhaug et al.	Jul 2002	B1
6442696	Wray et al.	Aug 2002	B1
6484315	Ziese	Nov 2002	B1
6487666	Shanklin et al.	Nov 2002	B1
6493756	O'Brien et al.	Dec 2002	B1
6550012	Villa et al.	Apr 2003	B1
6775657	Baker	Aug 2004	B1
6831893	Ben Nun et al.	Dec 2004	B1
6832367	Choi et al.	Dec 2004	B1
6895550	Kanchirayappa et al.	May 2005	B2
6898632	Gordy et al.	May 2005	B2
6907396	Muttik et al.	Jun 2005	B1
6941348	Petry et al.	Sep 2005	B2
6971097	Wallman	Nov 2005	B1
6981279	Arnold et al.	Dec 2005	B1
7007107	Ivchenko et al.	Feb 2006	B1
7028179	Anderson et al.	Apr 2006	B2
7043757	Hoefelmeyer et al.	May 2006	B2
7058822	Edery et al.	Jun 2006	B2
7069316	Gryaznov	Jun 2006	B1
7080407	Zhao et al.	Jul 2006	B1
7080408	Pak et al.	Jul 2006	B1
7093002	Wolff et al.	Aug 2006	B2
7093239	van der Made	Aug 2006	B1
7096498	Judge	Aug 2006	B2
7100201	Izatt	Aug 2006	B2
7107617	Hursey et al.	Sep 2006	B2
7146605	Beer et al.	Dec 2006	B2
7159149	Spiegel et al.	Jan 2007	B2
7213260	Judge	May 2007	B2
7231667	Jordan	Jun 2007	B2
7240364	Branscomb et al.	Jul 2007	B1
7240368	Roesch et al.	Jul 2007	B1
7243371	Kasper et al.	Jul 2007	B1
7249175	Donaldson	Jul 2007	B1
7287278	Liang	Oct 2007	B2
7308716	Danford et al.	Dec 2007	B2
7328453	Merkle, Jr. et al.	Feb 2008	B2
7346486	Ivancic et al.	Mar 2008	B2
7356736	Natvig	Apr 2008	B2
7386888	Liang et al.	Jun 2008	B2
7392542	Bucher	Jun 2008	B2
7418729	Szor	Aug 2008	B2
7428300	Drew et al.	Sep 2008	B1
7441272	Durham et al.	Oct 2008	B2
7448084	Apap et al.	Nov 2008	B1
7458098	Judge et al.	Nov 2008	B2
7464404	Carpenter et al.	Dec 2008	B2
7464407	Nakae et al.	Dec 2008	B2
7467408	O'Toole, Jr.	Dec 2008	B1
7478428	Thomlinson	Jan 2009	B1
7480773	Reed	Jan 2009	B1
7487543	Arnold et al.	Feb 2009	B2
7496960	Chen et al.	Feb 2009	B1
7496961	Zimmer et al.	Feb 2009	B2
7519990	Xie	Apr 2009	B1
7523493	Liang et al.	Apr 2009	B2
7530104	Thrower et al.	May 2009	B1
7540025	Tzadikario	May 2009	B2
7546638	Anderson et al.	Jun 2009	B2
7565550	Liang et al.	Jul 2009	B2
7568233	Szor et al.	Jul 2009	B1
7584455	Ball	Sep 2009	B2
7603715	Costa et al.	Oct 2009	B2
7607171	Marsden et al.	Oct 2009	B1
7639714	Stolfo et al.	Dec 2009	B2
7644441	Schmid et al.	Jan 2010	B2
7657419	van der Made	Feb 2010	B2
7676841	Sobchuk et al.	Mar 2010	B2
7698548	Shelest et al.	Apr 2010	B2
7707633	Danford et al.	Apr 2010	B2
7712136	Sprosts et al.	May 2010	B2
7730011	Deninger et al.	Jun 2010	B1
7739740	Nachenberg et al.	Jun 2010	B1
7779463	Stolfo et al.	Aug 2010	B2
7784097	Stolfo et al.	Aug 2010	B1
7832008	Kraemer	Nov 2010	B1
7836502	Zhao et al.	Nov 2010	B1
7849506	Dansey et al.	Dec 2010	B1
7854007	Sprosts et al.	Dec 2010	B2
7869073	Oshima	Jan 2011	B2
7877803	Enstone et al.	Jan 2011	B2
7904959	Sidiroglou et al.	Mar 2011	B2
7908660	Bahl	Mar 2011	B2
7930738	Petersen	Apr 2011	B1
7937387	Frazier et al.	May 2011	B2
7937761	Bennett	May 2011	B1
7949849	Lowe et al.	May 2011	B2
7996556	Raghavan et al.	Aug 2011	B2
7996836	McCorkendale et al.	Aug 2011	B1
7996904	Chiueh et al.	Aug 2011	B1
7996905	Arnold et al.	Aug 2011	B2
8006305	Aziz	Aug 2011	B2
8010667	Zhang et al.	Aug 2011	B2
8020206	Hubbard et al.	Sep 2011	B2
8028338	Schneider et al.	Sep 2011	B1
8042184	Batenin	Oct 2011	B1
8045094	Teragawa	Oct 2011	B2
8045458	Alperovitch et al.	Oct 2011	B2
8069484	McMillan et al.	Nov 2011	B2
8087086	Lai et al.	Dec 2011	B1
8171553	Aziz et al.	May 2012	B2
8176049	Deninger et al.	May 2012	B2
8176480	Spertus	May 2012	B1
8201246	Wu et al.	Jun 2012	B1
8204984	Aziz et al.	Jun 2012	B1
8214905	Doukhvalov et al.	Jul 2012	B1
8220055	Kennedy	Jul 2012	B1
8225288	Miller et al.	Jul 2012	B2
8225373	Kraemer	Jul 2012	B2
8233882	Rogel	Jul 2012	B2
8234640	Fitzgerald et al.	Jul 2012	B1
8234709	Viljoen et al.	Jul 2012	B2
8239944	Nachenberg et al.	Aug 2012	B1
8244516	Arbel et al.	Aug 2012	B2
8260914	Ranjan	Sep 2012	B1
8266091	Gubin et al.	Sep 2012	B1
8286251	Eker et al.	Oct 2012	B2
8291499	Aziz et al.	Oct 2012	B2
8307435	Mann et al.	Nov 2012	B1
8307443	Wang et al.	Nov 2012	B2
8312545	Tuvell et al.	Nov 2012	B2
8321936	Green et al.	Nov 2012	B1
8321941	Tuvell et al.	Nov 2012	B2
8332571	Edwards, Sr.	Dec 2012	B1
8347288	Brandwine	Jan 2013	B1
8365286	Poston	Jan 2013	B2
8365297	Parshin et al.	Jan 2013	B1
8370938	Daswani et al.	Feb 2013	B1
8370939	Zaitsev et al.	Feb 2013	B2
8375444	Aziz et al.	Feb 2013	B2
8381299	Stolfo et al.	Feb 2013	B2
8402529	Green et al.	Mar 2013	B1
8464340	Ahn et al.	Jun 2013	B2
8479174	Chiriac	Jul 2013	B2
8479276	Vaystikh et al.	Jul 2013	B1
8479291	Bodke	Jul 2013	B1
8510827	Leake et al.	Aug 2013	B1
8510828	Guo et al.	Aug 2013	B1
8510842	Amit et al.	Aug 2013	B2
8516478	Edwards et al.	Aug 2013	B1
8516590	Ranadive et al.	Aug 2013	B1
8516593	Aziz	Aug 2013	B2
8522348	Chen et al.	Aug 2013	B2
8528086	Aziz	Sep 2013	B1
8533824	Hutton et al.	Sep 2013	B2
8539582	Aziz et al.	Sep 2013	B1
8549638	Aziz	Oct 2013	B2
8555391	Demir et al.	Oct 2013	B1
8561177	Aziz et al.	Oct 2013	B1
8566476	Shiffer et al.	Oct 2013	B2
8566946	Aziz et al.	Oct 2013	B1
8584094	Dadhia et al.	Nov 2013	B2
8584234	Sobel et al.	Nov 2013	B1
8584239	Aziz et al.	Nov 2013	B2
8595834	Xie et al.	Nov 2013	B2
8627476	Satish et al.	Jan 2014	B1
8635696	Aziz	Jan 2014	B1
8682054	Xue et al.	Mar 2014	B2
8682812	Ranjan	Mar 2014	B1
8689333	Aziz	Apr 2014	B2
8695096	Zhang	Apr 2014	B1
8713631	Pavlyushchik	Apr 2014	B1
8713681	Silberman et al.	Apr 2014	B2
8726392	McCorkendale et al.	May 2014	B1
8739280	Chess et al.	May 2014	B2
8776229	Aziz	Jul 2014	B1
8782792	Bodke	Jul 2014	B1
8789172	Stolfo et al.	Jul 2014	B2
8789178	Kejriwal et al.	Jul 2014	B2
8793278	Frazier et al.	Jul 2014	B2
8793787	Ismael et al.	Jul 2014	B2
8805947	Kuzkin et al.	Aug 2014	B1
8806647	Daswani et al.	Aug 2014	B1
8832829	Manni et al.	Sep 2014	B2
8850570	Ramzan	Sep 2014	B1
8850571	Staniford et al.	Sep 2014	B2
8881234	Narasimhan et al.	Nov 2014	B2
8881271	Butler, II	Nov 2014	B2
8881282	Aziz et al.	Nov 2014	B1
8898788	Aziz et al.	Nov 2014	B1
8935779	Manni et al.	Jan 2015	B2
8949257	Shiffer et al.	Feb 2015	B2
8984638	Aziz et al.	Mar 2015	B1
8990939	Staniford et al.	Mar 2015	B2
8990944	Singh et al.	Mar 2015	B1
8997219	Staniford et al.	Mar 2015	B2
9009822	Ismael et al.	Apr 2015	B1
9009823	Ismael et al.	Apr 2015	B1
9027135	Aziz	May 2015	B1
9071638	Aziz et al.	Jun 2015	B1
9104867	Thioux et al.	Aug 2015	B1
9106630	Frazier et al.	Aug 2015	B2
9106694	Aziz et al.	Aug 2015	B2
9118715	Staniford et al.	Aug 2015	B2
9159035	Ismael et al.	Oct 2015	B1
9171160	Vincent et al.	Oct 2015	B2
9176843	Ismael et al.	Nov 2015	B1
9189627	Islam	Nov 2015	B1
9195829	Goradia et al.	Nov 2015	B1
9197664	Aziz et al.	Nov 2015	B1
9223972	Vincent et al.	Dec 2015	B1
9225740	Ismael et al.	Dec 2015	B1
9241010	Bennett et al.	Jan 2016	B1
9251343	Vincent et al.	Feb 2016	B1
9262635	Paithane et al.	Feb 2016	B2
9268936	Butler	Feb 2016	B2
9275229	LeMasters	Mar 2016	B2
9282109	Aziz et al.	Mar 2016	B1
9292686	Ismael	Mar 2016	B2
9294501	Mesdaq et al.	Mar 2016	B2
9300686	Pidathala et al.	Mar 2016	B2
9306960	Aziz	Apr 2016	B1
9306974	Aziz et al.	Apr 2016	B1
9311479	Manni et al.	Apr 2016	B1
9355247	Thioux et al.	May 2016	B1
9356944	Aziz	May 2016	B1
9363280	Rivlin et al.	Jun 2016	B1
9367681	Ismael et al.	Jun 2016	B1
9398028	Karandikar et al.	Jul 2016	B1
9413781	Cunningham et al.	Aug 2016	B2
9426071	Caldejon et al.	Aug 2016	B1
9430646	Mushtaq et al.	Aug 2016	B1
9432389	Khalid et al.	Aug 2016	B1
9438613	Paithane et al.	Sep 2016	B1
9438622	Staniford et al.	Sep 2016	B1
9438623	Thioux et al.	Sep 2016	B1
9459901	Jung et al.	Oct 2016	B2
9467460	Otvagin et al.	Oct 2016	B1
9483644	Paithane et al.	Nov 2016	B1
9495180	Ismael	Nov 2016	B2
9497213	Thompson et al.	Nov 2016	B2
9507935	Ismael et al.	Nov 2016	B2
9516057	Aziz	Dec 2016	B2
9519782	Aziz et al.	Dec 2016	B2
9536091	Paithane et al.	Jan 2017	B2
9537972	Edwards et al.	Jan 2017	B1
9560059	Islam	Jan 2017	B1
9565202	Kindlund et al.	Feb 2017	B1
9591015	Amin et al.	Mar 2017	B1
9591020	Aziz	Mar 2017	B1
9594904	Jain et al.	Mar 2017	B1
9594905	Ismael et al.	Mar 2017	B1
9594912	Thioux et al.	Mar 2017	B1
9609007	Rivlin et al.	Mar 2017	B1
9626509	Khalid et al.	Apr 2017	B1
9628498	Aziz et al.	Apr 2017	B1
9628507	Haq et al.	Apr 2017	B2
9633134	Ross	Apr 2017	B2
9635039	Islam et al.	Apr 2017	B1
9641546	Manni et al.	May 2017	B1
9654485	Neumann	May 2017	B1
9661009	Karandikar et al.	May 2017	B1
9661018	Aziz	May 2017	B1
9674298	Edwards et al.	Jun 2017	B1
9680862	Ismael et al.	Jun 2017	B2
9690606	Ha et al.	Jun 2017	B1
9690933	Singh et al.	Jun 2017	B1
9690935	Shiffer et al.	Jun 2017	B2
9690936	Malik et al.	Jun 2017	B1
9736179	Ismael	Aug 2017	B2
9740857	Ismael et al.	Aug 2017	B2
9747446	Pidathala et al.	Aug 2017	B1
9756074	Aziz et al.	Sep 2017	B2
9773112	Rathor et al.	Sep 2017	B1
9781144	Otvagin et al.	Oct 2017	B1
9787700	Amin et al.	Oct 2017	B1
9787706	Otvagin et al.	Oct 2017	B1
9792196	Ismael et al.	Oct 2017	B1
9824209	Ismael et al.	Nov 2017	B1
9824211	Wilson	Nov 2017	B2
9824216	Khalid et al.	Nov 2017	B1
9825976	Gomez et al.	Nov 2017	B1
9825989	Mehra et al.	Nov 2017	B1
9838408	Karandikar et al.	Dec 2017	B1
9838411	Aziz	Dec 2017	B1
9838416	Aziz	Dec 2017	B1
9838417	Khalid et al.	Dec 2017	B1
9846776	Paithane et al.	Dec 2017	B1
9876701	Caldejon et al.	Jan 2018	B1
9888016	Amin et al.	Feb 2018	B1
9888019	Pidathala et al.	Feb 2018	B1
9910988	Vincent et al.	Mar 2018	B1
9912644	Cunningham	Mar 2018	B2
9912681	Ismael et al.	Mar 2018	B1
9912684	Aziz et al.	Mar 2018	B1
9912691	Mesdaq et al.	Mar 2018	B2
9912698	Thioux et al.	Mar 2018	B1
9916440	Paithane et al.	Mar 2018	B1
9921978	Chan et al.	Mar 2018	B1
9934376	Ismael	Apr 2018	B1
9934381	Kindlund et al.	Apr 2018	B1
9946568	Ismael et al.	Apr 2018	B1
9954890	Staniford et al.	Apr 2018	B1
9973531	Thioux	May 2018	B1
10002252	Ismael et al.	Jun 2018	B2
10019338	Goradia et al.	Jul 2018	B1
10019573	Silberman et al.	Jul 2018	B2
10025691	Ismael et al.	Jul 2018	B1
10025927	Khalid et al.	Jul 2018	B1
10027689	Rathor et al.	Jul 2018	B1
10027690	Aziz et al.	Jul 2018	B2
10027696	Rivlin et al.	Jul 2018	B1
10033747	Paithane et al.	Jul 2018	B1
10033748	Cunningham et al.	Jul 2018	B1
10033753	Islam et al.	Jul 2018	B1
10033759	Kabra et al.	Jul 2018	B1
10050998	Singh	Aug 2018	B1
10068091	Aziz et al.	Sep 2018	B1
10075455	Zafar et al.	Sep 2018	B2
10083302	Paithane et al.	Sep 2018	B1
10084813	Eyada	Sep 2018	B2
10089461	Ha et al.	Oct 2018	B1
10097573	Aziz	Oct 2018	B1
10104102	Neumann	Oct 2018	B1
10108446	Steinberg et al.	Oct 2018	B1
10121000	Rivlin et al.	Nov 2018	B1
10122746	Manni et al.	Nov 2018	B1
10133863	Bu et al.	Nov 2018	B2
10133866	Kumar et al.	Nov 2018	B1
10146810	Shiffer et al.	Dec 2018	B2
10148693	Singh et al.	Dec 2018	B2
10165000	Aziz et al.	Dec 2018	B1
10169585	Pilipenko et al.	Jan 2019	B1
10176321	Abbasi et al.	Jan 2019	B2
10181029	Ismael et al.	Jan 2019	B1
10191861	Steinberg et al.	Jan 2019	B1
10192052	Singh et al.	Jan 2019	B1
10198574	Thioux et al.	Feb 2019	B1
10200384	Mushtaq et al.	Feb 2019	B1
10210329	Malik et al.	Feb 2019	B1
10216927	Steinberg	Feb 2019	B1
10218740	Mesdaq et al.	Feb 2019	B1
10242185	Goradia	Mar 2019	B1
20010005889	Albrecht	Jun 2001	A1
20010047326	Broadbent et al.	Nov 2001	A1
20020018903	Kokubo et al.	Feb 2002	A1
20020019941	Chan et al.	Feb 2002	A1
20020038430	Edwards et al.	Mar 2002	A1
20020091819	Melchione et al.	Jul 2002	A1
20020095607	Lin-Hendel	Jul 2002	A1
20020116627	Tarbotton et al.	Aug 2002	A1
20020144156	Copeland	Oct 2002	A1
20020162015	Tang	Oct 2002	A1
20020166063	Lachman et al.	Nov 2002	A1
20020169952	DiSanto et al.	Nov 2002	A1
20020184528	Shevenell et al.	Dec 2002	A1
20020188887	Largman et al.	Dec 2002	A1
20020194490	Halperin et al.	Dec 2002	A1
20030021728	Sharpe et al.	Jan 2003	A1
20030074578	Ford et al.	Apr 2003	A1
20030084318	Schertz	May 2003	A1
20030101381	Mateev et al.	May 2003	A1
20030115483	Liang	Jun 2003	A1
20030188190	Aaron et al.	Oct 2003	A1
20030191957	Hypponen et al.	Oct 2003	A1
20030200460	Morota et al.	Oct 2003	A1
20030212902	van der Made	Nov 2003	A1
20030229801	Kouznetsov et al.	Dec 2003	A1
20030237000	Denton et al.	Dec 2003	A1
20040003323	Bennett et al.	Jan 2004	A1
20040006473	Mills et al.	Jan 2004	A1
20040015712	Szor	Jan 2004	A1
20040019832	Arnold et al.	Jan 2004	A1
20040047356	Bauer	Mar 2004	A1
20040083408	Spiegel et al.	Apr 2004	A1
20040088581	Brawn et al.	May 2004	A1
20040093513	Cantrell et al.	May 2004	A1
20040111531	Staniford et al.	Jun 2004	A1
20040117478	Triulzi et al.	Jun 2004	A1
20040117624	Brandt et al.	Jun 2004	A1
20040128355	Chao et al.	Jul 2004	A1
20040165588	Pandya	Aug 2004	A1
20040236963	Danford et al.	Nov 2004	A1
20040243349	Greifeneder et al.	Dec 2004	A1
20040249911	Alkhatib et al.	Dec 2004	A1
20040255161	Cavanaugh	Dec 2004	A1
20040268147	Wiederin et al.	Dec 2004	A1
20050005159	Oliphant	Jan 2005	A1
20050021740	Bar et al.	Jan 2005	A1
20050033960	Vialen et al.	Feb 2005	A1
20050033989	Poletto et al.	Feb 2005	A1
20050050148	Mohammadioun et al.	Mar 2005	A1
20050086523	Zimmer et al.	Apr 2005	A1
20050091513	Mitomo et al.	Apr 2005	A1
20050091533	Omote et al.	Apr 2005	A1
20050091652	Ross et al.	Apr 2005	A1
20050108562	Khazan et al.	May 2005	A1
20050114663	Cornell et al.	May 2005	A1
20050125195	Brendel	Jun 2005	A1
20050149726	Joshi et al.	Jul 2005	A1
20050157662	Bingham et al.	Jul 2005	A1
20050183143	Anderholm et al.	Aug 2005	A1
20050201297	Peikari	Sep 2005	A1
20050210533	Copeland et al.	Sep 2005	A1
20050238005	Chen et al.	Oct 2005	A1
20050240781	Gassoway	Oct 2005	A1
20050262562	Gassoway	Nov 2005	A1
20050265331	Stolfo	Dec 2005	A1
20050283839	Cowburn	Dec 2005	A1
20060010495	Cohen et al.	Jan 2006	A1
20060015416	Hoffman et al.	Jan 2006	A1
20060015715	Anderson	Jan 2006	A1
20060015747	Van de Ven	Jan 2006	A1
20060021029	Brickell et al.	Jan 2006	A1
20060021054	Costa et al.	Jan 2006	A1
20060031476	Mathes et al.	Feb 2006	A1
20060047665	Neil	Mar 2006	A1
20060070130	Costea et al.	Mar 2006	A1
20060075496	Carpenter et al.	Apr 2006	A1
20060095968	Portolani et al.	May 2006	A1
20060101516	Sudaharan et al.	May 2006	A1
20060101517	Banzhof et al.	May 2006	A1
20060117385	Mester et al.	Jun 2006	A1
20060123477	Raghavan et al.	Jun 2006	A1
20060143709	Brooks et al.	Jun 2006	A1
20060150249	Gassen et al.	Jul 2006	A1
20060161983	Cothrell et al.	Jul 2006	A1
20060161987	Levy-Yurista	Jul 2006	A1
20060161989	Reshef et al.	Jul 2006	A1
20060164199	Gilde et al.	Jul 2006	A1
20060173992	Weber et al.	Aug 2006	A1
20060179147	Tran et al.	Aug 2006	A1
20060184632	Marino et al.	Aug 2006	A1
20060191010	Benjamin	Aug 2006	A1
20060221956	Narayan et al.	Oct 2006	A1
20060236393	Kramer et al.	Oct 2006	A1
20060242709	Seinfeld et al.	Oct 2006	A1
20060248519	Jaeger et al.	Nov 2006	A1
20060248582	Panjwani et al.	Nov 2006	A1
20060251104	Koga	Nov 2006	A1
20060288417	Bookbinder et al.	Dec 2006	A1
20070006288	Mayfield et al.	Jan 2007	A1
20070006313	Porras et al.	Jan 2007	A1
20070011174	Takaragi et al.	Jan 2007	A1
20070016951	Piccard et al.	Jan 2007	A1
20070019286	Kikuchi	Jan 2007	A1
20070033645	Jones	Feb 2007	A1
20070038943	FitzGerald et al.	Feb 2007	A1
20070064689	Shin et al.	Mar 2007	A1
20070074169	Chess et al.	Mar 2007	A1
20070094730	Bhikkaji et al.	Apr 2007	A1
20070101435	Konanka et al.	May 2007	A1
20070128855	Cho et al.	Jun 2007	A1
20070142030	Sinha et al.	Jun 2007	A1
20070143827	Nicodemus et al.	Jun 2007	A1
20070156895	Vuong	Jul 2007	A1
20070157180	Tillmann et al.	Jul 2007	A1
20070157306	Elrod et al.	Jul 2007	A1
20070168988	Eisner et al.	Jul 2007	A1
20070171824	Ruello et al.	Jul 2007	A1
20070174915	Gribble et al.	Jul 2007	A1
20070192500	Lum	Aug 2007	A1
20070192858	Lum	Aug 2007	A1
20070198275	Malden et al.	Aug 2007	A1
20070208822	Wang et al.	Sep 2007	A1
20070220607	Sprosts et al.	Sep 2007	A1
20070240218	Tuvell et al.	Oct 2007	A1
20070240219	Tuvell et al.	Oct 2007	A1
20070240220	Tuvell et al.	Oct 2007	A1
20070240222	Tuvell et al.	Oct 2007	A1
20070250930	Aziz et al.	Oct 2007	A1
20070256132	Oliphant	Nov 2007	A2
20070271446	Nakamura	Nov 2007	A1
20080005782	Aziz	Jan 2008	A1
20080018122	Zierler et al.	Jan 2008	A1
20080028463	Dagon et al.	Jan 2008	A1
20080040710	Chiriac	Feb 2008	A1
20080046781	Childs et al.	Feb 2008	A1
20080066179	Liu	Mar 2008	A1
20080072326	Danford et al.	Mar 2008	A1
20080077793	Tan et al.	Mar 2008	A1
20080080518	Hoeflin et al.	Apr 2008	A1
20080086720	Lekel	Apr 2008	A1
20080098476	Syversen	Apr 2008	A1
20080120722	Sima et al.	May 2008	A1
20080134178	Fitzgerald et al.	Jun 2008	A1
20080134334	Kim et al.	Jun 2008	A1
20080141376	Clausen et al.	Jun 2008	A1
20080184367	McMillan et al.	Jul 2008	A1
20080184373	Traut et al.	Jul 2008	A1
20080189787	Arnold et al.	Aug 2008	A1
20080201778	Guo et al.	Aug 2008	A1
20080209557	Herley et al.	Aug 2008	A1
20080215742	Goldszmidt et al.	Sep 2008	A1
20080222729	Chen et al.	Sep 2008	A1
20080244569	Challener et al.	Oct 2008	A1
20080263665	Ma et al.	Oct 2008	A1
20080295172	Bohacek	Nov 2008	A1
20080301810	Lehane et al.	Dec 2008	A1
20080307524	Singh et al.	Dec 2008	A1
20080313738	Enderby	Dec 2008	A1
20080320594	Jiang	Dec 2008	A1
20090003317	Kasralikar et al.	Jan 2009	A1
20090007100	Field et al.	Jan 2009	A1
20090013408	Schipka	Jan 2009	A1
20090031423	Liu et al.	Jan 2009	A1
20090036111	Danford et al.	Feb 2009	A1
20090037835	Goldman	Feb 2009	A1
20090044024	Oberheide et al.	Feb 2009	A1
20090044274	Budko et al.	Feb 2009	A1
20090064332	Porras et al.	Mar 2009	A1
20090077666	Chen et al.	Mar 2009	A1
20090083369	Marmor	Mar 2009	A1
20090083855	Apap et al.	Mar 2009	A1
20090089879	Wang et al.	Apr 2009	A1
20090094697	Proves et al.	Apr 2009	A1
20090113425	Ports et al.	Apr 2009	A1
20090125976	Wassermann et al.	May 2009	A1
20090126015	Monastyrsky et al.	May 2009	A1
20090126016	Sobko et al.	May 2009	A1
20090133125	Choi et al.	May 2009	A1
20090144823	Lamastra et al.	Jun 2009	A1
20090158430	Borders	Jun 2009	A1
20090172815	Gu et al.	Jul 2009	A1
20090187992	Poston	Jul 2009	A1
20090193293	Stolfo et al.	Jul 2009	A1
20090198651	Shiffer et al.	Aug 2009	A1
20090198670	Shiffer et al.	Aug 2009	A1
20090198689	Frazier et al.	Aug 2009	A1
20090199274	Frazier et al.	Aug 2009	A1
20090199296	Xie et al.	Aug 2009	A1
20090228233	Anderson et al.	Sep 2009	A1
20090241187	Troyansky	Sep 2009	A1
20090241190	Todd et al.	Sep 2009	A1
20090265692	Godefroid et al.	Oct 2009	A1
20090271867	Zhang	Oct 2009	A1
20090300415	Zhang et al.	Dec 2009	A1
20090300761	Park et al.	Dec 2009	A1
20090328185	Berg et al.	Dec 2009	A1
20090328221	Blumfield et al.	Dec 2009	A1
20100005146	Drako et al.	Jan 2010	A1
20100011205	McKenna	Jan 2010	A1
20100017546	Poo et al.	Jan 2010	A1
20100030996	Butler, II	Feb 2010	A1
20100031353	Thomas et al.	Feb 2010	A1
20100037314	Perdisci et al.	Feb 2010	A1
20100043073	Kuwamura	Feb 2010	A1
20100054278	Stolfo et al.	Mar 2010	A1
20100058474	Hicks	Mar 2010	A1
20100064044	Nonoyama	Mar 2010	A1
20100077481	Polyakov et al.	Mar 2010	A1
20100083376	Pereira et al.	Apr 2010	A1
20100115621	Staniford et al.	May 2010	A1
20100132038	Zaitsev	May 2010	A1
20100153924	Andrews	Jun 2010	A1
20100154056	Smith et al.	Jun 2010	A1
20100180344	Malyshev et al.	Jul 2010	A1
20100192223	Ismael et al.	Jul 2010	A1
20100220863	Dupaquis et al.	Sep 2010	A1
20100235831	Dittmer	Sep 2010	A1
20100251104	Massand	Sep 2010	A1
20100281102	Chinta et al.	Nov 2010	A1
20100281541	Stolfo et al.	Nov 2010	A1
20100281542	Stolfo et al.	Nov 2010	A1
20100287260	Peterson et al.	Nov 2010	A1
20100299754	Amit et al.	Nov 2010	A1
20100306173	Frank	Dec 2010	A1
20110004737	Greenebaum	Jan 2011	A1
20110025504	Lyon et al.	Feb 2011	A1
20110041179	St Hlberg	Feb 2011	A1
20110047594	Mahaffey et al.	Feb 2011	A1
20110047620	Mahaffey et al.	Feb 2011	A1
20110055907	Narasimhan et al.	Mar 2011	A1
20110078794	Manni et al.	Mar 2011	A1
20110093951	Aziz	Apr 2011	A1
20110099620	Stavrou et al.	Apr 2011	A1
20110099633	Aziz	Apr 2011	A1
20110099635	Silberman et al.	Apr 2011	A1
20110113231	Kaminsky	May 2011	A1
20110145918	Jung et al.	Jun 2011	A1
20110145920	Mahaffey et al.	Jun 2011	A1
20110145934	Abramovici et al.	Jun 2011	A1
20110167493	Song et al.	Jul 2011	A1
20110167494	Bowen et al.	Jul 2011	A1
20110173213	Frazier et al.	Jul 2011	A1
20110173460	Ito et al.	Jul 2011	A1
20110219449	St. Neitzel et al.	Sep 2011	A1
20110219450	McDougal et al.	Sep 2011	A1
20110225624	Sawhney et al.	Sep 2011	A1
20110225655	Niemela et al.	Sep 2011	A1
20110247072	Staniford et al.	Oct 2011	A1
20110258607	Bhatt et al.	Oct 2011	A1
20110265182	Peinado et al.	Oct 2011	A1
20110289582	Kejriwal et al.	Nov 2011	A1
20110302587	Nishikawa et al.	Dec 2011	A1
20110307954	Melnik et al.	Dec 2011	A1
20110307955	Kaplan et al.	Dec 2011	A1
20110307956	Yermakov et al.	Dec 2011	A1
20110314546	Aziz et al.	Dec 2011	A1
20120023593	Puder et al.	Jan 2012	A1
20120054869	Yen et al.	Mar 2012	A1
20120066698	Yanoo	Mar 2012	A1
20120079596	Thomas et al.	Mar 2012	A1
20120084859	Radinsky et al.	Apr 2012	A1
20120096553	Srivastava et al.	Apr 2012	A1
20120110667	Zubrilin et al.	May 2012	A1
20120117652	Manni et al.	May 2012	A1
20120121154	Xue et al.	May 2012	A1
20120124426	Maybee et al.	May 2012	A1
20120174186	Aziz et al.	Jul 2012	A1
20120174196	Bhogavilli et al.	Jul 2012	A1
20120174218	McCoy et al.	Jul 2012	A1
20120198279	Schroeder	Aug 2012	A1
20120198514	McCune et al.	Aug 2012	A1
20120210423	Friedrichs et al.	Aug 2012	A1
20120222121	Staniford et al.	Aug 2012	A1
20120255015	Sahita et al.	Oct 2012	A1
20120255017	Sallam	Oct 2012	A1
20120260342	Dube et al.	Oct 2012	A1
20120260345	Quinn et al.	Oct 2012	A1
20120266244	Green et al.	Oct 2012	A1
20120278886	Luna	Nov 2012	A1
20120297489	Dequevy	Nov 2012	A1
20120330801	McDougal et al.	Dec 2012	A1
20120331553	Aziz et al.	Dec 2012	A1
20130014259	Gribble et al.	Jan 2013	A1
20130036472	Aziz	Feb 2013	A1
20130047257	Aziz	Feb 2013	A1
20130074185	McDougal et al.	Mar 2013	A1
20130086684	Mohler	Apr 2013	A1
20130097699	Balupari et al.	Apr 2013	A1
20130097706	Titonis et al.	Apr 2013	A1
20130111587	Goel et al.	May 2013	A1
20130117852	Stute	May 2013	A1
20130117855	Kim et al.	May 2013	A1
20130139264	Brinkley et al.	May 2013	A1
20130160125	Likhachev et al.	Jun 2013	A1
20130160127	Jeong et al.	Jun 2013	A1
20130160130	Mendelev et al.	Jun 2013	A1
20130160131	Madou et al.	Jun 2013	A1
20130167236	Sick	Jun 2013	A1
20130174214	Duncan	Jul 2013	A1
20130185789	Hagiwara et al.	Jul 2013	A1
20130185795	Winn et al.	Jul 2013	A1
20130185798	Saunders et al.	Jul 2013	A1
20130191915	Antonakakis et al.	Jul 2013	A1
20130196649	Paddon et al.	Aug 2013	A1
20130227691	Aziz et al.	Aug 2013	A1
20130246370	Bartram et al.	Sep 2013	A1
20130247186	LeMasters	Sep 2013	A1
20130254772	Corthesy	Sep 2013	A1
20130263260	Mahaffey et al.	Oct 2013	A1
20130291109	Staniford et al.	Oct 2013	A1
20130298243	Kumar et al.	Nov 2013	A1
20130318038	Shiffer et al.	Nov 2013	A1
20130318073	Shiffer et al.	Nov 2013	A1
20130325791	Shiffer et al.	Dec 2013	A1
20130325792	Shiffer et al.	Dec 2013	A1
20130325871	Shiffer et al.	Dec 2013	A1
20130325872	Shiffer et al.	Dec 2013	A1
20140032875	Butler	Jan 2014	A1
20140053260	Gupta et al.	Feb 2014	A1
20140053261	Gupta et al.	Feb 2014	A1
20140075522	Paris et al.	Mar 2014	A1
20140130158	Wang	May 2014	A1
20140137180	Lukacs et al.	May 2014	A1
20140169762	Ryu	Jun 2014	A1
20140179360	Jackson et al.	Jun 2014	A1
20140181131	Ross	Jun 2014	A1
20140189687	Jung et al.	Jul 2014	A1
20140189866	Shiffer et al.	Jul 2014	A1
20140189882	Jung et al.	Jul 2014	A1
20140237600	Silberman et al.	Aug 2014	A1
20140280245	Wilson	Sep 2014	A1
20140283037	Sikorski et al.	Sep 2014	A1
20140283063	Thompson et al.	Sep 2014	A1
20140328204	Klotsche et al.	Nov 2014	A1
20140337836	Ismael	Nov 2014	A1
20140344926	Cunningham et al.	Nov 2014	A1
20140351935	Shao et al.	Nov 2014	A1
20140380473	Bu et al.	Dec 2014	A1
20140380474	Paithane et al.	Dec 2014	A1
20150007312	Pidathala et al.	Jan 2015	A1
20150096022	Vincent et al.	Apr 2015	A1
20150096023	Mesdaq et al.	Apr 2015	A1
20150096024	Haq et al.	Apr 2015	A1
20150096025	Ismael	Apr 2015	A1
20150180886	Staniford et al.	Jun 2015	A1
20150186645	Aziz et al.	Jul 2015	A1
20150199513	Ismael et al.	Jul 2015	A1
20150199531	Ismael et al.	Jul 2015	A1
20150199532	Ismael et al.	Jul 2015	A1
20150220735	Paithane et al.	Aug 2015	A1
20150372980	Eyada	Dec 2015	A1
20160004869	Ismael et al.	Jan 2016	A1
20160006756	Ismael et al.	Jan 2016	A1
20160044000	Cunningham	Feb 2016	A1
20160127393	Aziz et al.	May 2016	A1
20160191547	Zafar et al.	Jun 2016	A1
20160191550	Ismael et al.	Jun 2016	A1
20160261612	Mesdaq et al.	Sep 2016	A1
20160285914	Singh et al.	Sep 2016	A1
20160301703	Aziz	Oct 2016	A1
20160335110	Paithane et al.	Nov 2016	A1
20170083703	Abbasi et al.	Mar 2017	A1
20180013770	Ismael	Jan 2018	A1
20180048660	Paithane et al.	Feb 2018	A1
20180121316	Ismael et al.	May 2018	A1
20180288077	Siddiqui et al.	Oct 2018	A1

Foreign Referenced Citations (12)

Number	Date	Country
2439806	Jan 2008	GB
2490431	Oct 2012	GB
0206928	Jan 2002	WO
0223805	Mar 2002	WO
2007117636	Oct 2007	WO
2008041950	Apr 2008	WO
2009095741	Aug 2009	WO
2011084431	Jul 2011	WO
2011112348	Sep 2011	WO
2012075336	Jun 2012	WO
2012145066	Oct 2012	WO
2013067505	May 2013	WO

Non-Patent Literature Citations (92)

Entry
“Mining Specification of Malicious Behavior”—Jha et al., UCSB, Sep. 2007 https://www.cs.ucsb.edu/.about.chris/research/doc/esec07.sub.-mining.pdf-.
“Network Security: NetDetector—Network Intrusion Forensic System (NIFS) Whitepaper”, (“NetDetector Whitepaper”), (2003).
“When Virtual is Better Than Real”, lEEEXplore Digital Library, available at, http://ieeexplore.ieee.org/xpl/articleDetails.isp?reload=true&arnumbe-r=990073, (Dec. 7, 2013).
Abdullah, et al., Visualizing Network Data for Intrusion Detection, 2005 IEEE Workshop on Information Assurance and Security, pp. 100-108.
Adetoye, Adedayo , et al., “Network Intrusion Detection & Response System”, (“Adetoye”), (Sep. 2003).
Apostolopoulos, George; hassapis, Constantinos; “V-eM: A cluster of Virtual Machines for Robust, Detailed, and High-Performance Network Emulation”, 14th IEEE International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, Sep. 11-14, 2006, pp. 117-126.
Aura, Tuomas, “Scanning electronic documents for personally identifiable information”, Proceedings of the 5th ACM workshop on Privacy in electronic society. ACM, 2006.
Baecher, “The Nepenthes Platform: An Efficient Approach to collect Malware”, Springer-verlag Berlin Heidelberg, (2006), pp. 165-184.
Bayer, et al., “Dynamic Analysis of Malicious Code”, J Comput Virol, Springer-Verlag, France., (2006), pp. 67-77.
Boubalos, Chris , “extracting syslog data out of raw pcap dumps, seclists.org, Honeypots mailing list archives”, available at http://seclists.org/honeypots/2003/q2/319 (“Boubalos”), (Jun. 5, 2003).
Brucker, et al., “On theorem prover-based testing, Formal Aspects of Computing,” 25.5 (2013), pp. 683-721.
Chaudet, C., et al., “Optimal Positioning of Active and Passive Monitoring Devices”, International Conference on Emerging Networking Experiments and Technologies, Proceedings of the 2005 ACM Conference on Emerging Network Experiment and Technology, CoNEXT '05, Toulousse, France, (Oct. 2005), pp. 71-82.
Chen, P. M. and Noble, B. D., “When Virtual is Better Than Real, Department of Electrical Engineering and Computer Science”, University of Michigan (“Chen”) (2001).
Cisco “Intrusion Prevention for the Cisco ASA 5500-x Series” Data Sheet (2012).
Cohen, M I., “PyFlag-An advanced network forensic framework”, Digital investigation 5, Elsevier, (2008), pp. S112-S120.
Common Criteria for Information Technology Security Evaluation, Part 3: Security assurance components Version 3.1, Revision 4, CCMB-2012,—Sep. 2012, 233 pages.
Costa, M., et al., “Vigilante: End-to-End Containment of Internet Worms”, SOSP '05, Association for Computing Machinery, Inc., Brighton U.K , (Oct. 23-26, 2005).
Crocker, et al., Verification of C programs using automated reasoning, Software Engineering and Formal Methods, 2007 SEFM 2007. Fifth IEEE International Conference on. IEEE, 2007. pp. 7-14.
Del Grosso et al., “An evolutionary testing approach to detect buffer overflow,” Student Paper Proceedings of the International Symposium of Software Reliability Engineering (ISSRE), St. Malo, France, 2004, 2 pages.
Didier Stevens, “Malicious PDF Documents Explained”, Security & Privacy, IEEE, IEEE Service Center, Los Alamitos, CA, US, vol. 9, No. 1, Jan. 1, 2011, pp. 80-82, XP011329453, ISSN: 1540-7993, DOI: 10 1109/MSP.2011.14.
Distler, “Malware Analysis: An Introduction”, SANS Institute InfoSec Reading Room, SANS Institute, (2007).
Dunlap, George W. , et al., “ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay”, Proceeding of the 5th Symposium on Operating Systems Design and Implementation, USENIX Association, (“Dunlap”), (Dec. 9, 2002).
Dybjer, et al.. Verifying Haskell programs by combining testing and proving, Quality Software, 2003. Proceedings. Third International Conference, IEEE, 2003, 8 pages.
Fernandez, et al. “CAmkES glue code semantics.” Apr. 2013, 45 pages.
Fernandez, et al. “Towards a verified component platform.” Proceedings of the Seventh Workshop on Programming Languages and Operating Systems. ACM, 2013, 7 pages.
FireEye Malware Analysis & Exchange Network, Malware Protection System, FireEye Inc., 2010.
FireEye Malware Analysis, Modern Malware Forensics, FireEye Inc., 2010.
FireEye v.6.0 Security Target, pp. 1-35, Version 1.1, FireEye Inc., May 2011.
Garfinkel., et al. “Terra: A virtual machine-based platform for trusted computing.” ACM SIGOPS '03. ACM, Oct. 2003, 14 pages.
Gebhardt, Carl. “Towards Trustworthy Virtualisation: Improving the Trusted Virtual Infrastructure.” Technical Report RHUL-MA-2011-10, Mar. 17, 214 pages.
Goel, et al., Reconstructing System State for Intrusion Analysis, Apr. 2008 SIGOPS Operating Systems Review, vol. 42 Issue 3, pp. 21-28.
Gollmann, Dieter “Why trust is bad for security.” Electronic notes in theoretical computer science 157.3, 2006, pp. 3-9.
Gregg Keizer: “Microsoft's HoneyMonkeys Show Patching Windows Works”, Aug. 8, 2005, XP055143386, Retrieved from the Internet: URL:http://www.informationweek.com/microsofts-honeymonkeys-show-patching-windows-works/d/d-d/1035069? [retrieved on Jun. 1, 2016].
Heng Yin et al, Panorama: Capturing System-Wide Information Flow for Malware Detection and Analysis, Research Showcase @ CMU, Carnegie Mellon University, 2007.
Hepburn, et al. “Execution Contexts for Determining Trust in a Higher-Order pi-Calculus.” School of Computing, University of Tasmania Technical Report R-01-2003, 2003, 36 pages.
Hiroshi Shinotsuka, Malware Authors Using New Techniques to Evade Automated Threat Analysis Systems, Oct. 26, 2012, http://www.symantec.com/connect/blogs/, pp. 1-4.
Hudak, Paul, “Conception, evolution, and application of functional programming languages.” ACM Computing Surveys (CSUR) 21 .3 (1989): 359-411.
Idika et al., A-Survey-of-Malware-Detection-Techniques, Feb. 2, 2007, Department of Computer Science, Purdue University.
Isohara, Takamasa, Keisuke Takemori, and Ayumu Kubota. “Kernel-based behavior analysis for android malware detection.” Computational intelligence and Security (CIS), 2011 Seventh International Conference on. IEEE, 2011.
Kaeo, Merike , “Designing Network Security”, (“Kaeo”), (Nov. 2003).
Kevin A Roundy et al: “Hybrid Analysis and Control of Malware”, Sep. 15, 2010, Recent Advances in Intrusion Detection, Springer Berlin Heidelberg, Berlin, Heidelberg, pp. 317-338, XP019150454 ISBN:978-3-642-15511-6.
Khaled Salah et al: “Using Cloud Computing to Implement a Security Overlay Network”, Security & Privacy, IEEE, IEEE Service Center, Los Alamitos, CA, US, vol. 11, No. 1, Jan. 1, 2013 (Jan. 1, 2013).
Kim, H., et al., “Autograph: Toward Automated, Distributed Worm Signature Detection”, Proceedings of the 13th Usenix Security Symposium (Security 2004), San Diego, (Aug. 2004), pp. 271-286.
King, Samuel T., et al., “Operating System Support for Virtual Machines”, (“King”), (2003).
Klein, et al. “seL4: Formal verification of an OS kernel.” Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles. ACM, 2009, pp. 207-220.
Kreibich, C. , et al., “Honeycomb-Creating Intrusion Detection Signatures Using Honeypots”, 2nd Workshop on Hot Topics in Networks (HotNets-11), Boston, USA, (2003).
Kristoff, J., “Botnets, Detection and Mitigation: DNS-Based Techniques”, NU Security Day, (2005), 23 pages.
Lastline Labs, The Threat of Evasive Malware, Feb. 25, 2013, Lastline Labs, pp. 1-8.
Latham, Donald C. “Deparlnent of Defense Trusted Computer System Evaluation Criteria.” Department of Defense (1986), 116 pages.
Li et al., A VMM-Based System Call Interposition Framework for Program Monitoring, Dec. 2010, IEEE 16th International Conference on Parallel and Distributed Systems, pp. 706-711.
Lindorfer, Martina, Clemens Kolbitsch, and Paolo Milani Comparetti. “Detecting environment-sensitive malware.” Recent Advances in Intrusion Detection. Springer Berlin Heidelberg, 2011.
Marchette, David J., “Computer Intrusion Detection and Network Monitoring: A Statistical Viewpoint”, (“Marchette”), (2001).
McCune, et al. “Flicker: An execution infrastructure for TCB minimization.” ACM SIGOPS Operating Systems Review. vol. 42. No. 4. ACM, 2008, 14 pages.
McCune, et al. “TrustVisor: Efficient TCB reduction and attestation.” CyLab, Carnegie Mellon University, CMU-CyLab-09-003, Mar. 9, 2009 (revised Mar. 10, 2010), 17 pages.
Mohammad et al. “A component-based development process for trustworthy systems.” ACTS Research Group, ACTS Report Series, Sep. 2009, 48 pages.
Mohammad, et al “A formal approach for the specification and verification of trustworthy component based systems.” ACTS Research Group, ACTS Report Series, May 2009, 73 pages.
Moore, D. , et al., “Internet Quarantine: Requirements for Containing Self-Propagating Code”, INFOCOM, vol. 3, (Mar. 30-Apr. 3, 2003), pp. 1901-1910.
Morales, Jose A., et al., ““Analyzing and exploiting network behaviors of malware.””, Security and Privacy in Communication Networks. Springer Berlin Heidelberg, 2010. 20-34.
Mori, Detecting Unknown Computer Viruses, 2004, Springer-Verlag Berlin Heidelberg.
Natvig, Kurt, “SANDBOXII: Internet”, Virus Bulletin Conference, (“Natvig”), (Sep. 2002).
NetBIOS Working Group. Protocol Standard fora NetBIOS Service on a TCP/UDP transport: Concepts and Methods. STD 19, RFC 1001, Mar. 1987.
Newsome, J. , et al., “Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software”, In Proceedings of the 12th Annual Network and Distributed System Security, Symposium (NDSS '05), (Feb. 2005).
Nojiri, D. , et al., “Cooperation Response Strategies for Large Scale Attack Mitigation”, DARPA Information Survivability Conference and Exposition, vol. 1, (Apr. 22-24, 2003), pp. 293-302.
Oberheide et al., CloudAV.sub.-N-Version Antivirus in the Network Cloud, 17th USENIX Security Symposium USENIX Security '08 Jul. 28-Aug. 1, 2008 San Jose, CA.
Parker, Timothy. Protecting Cryptographic Keys and Functions from Malware Attacks. Diss, Texas Univ At San Antonio Dept of Computer Science, 2010, 116 pages.
Pamo, Bryan, Thesis—“Trust extension as a mechanism for secure code execution on commodity computers.” 2010, 203 pages.
PCT Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration, International Searching Authority, International Application No. PCT/US2015/038616, dated Sep. 16, 2015, 9 pages.
Popovic et al., An approach to formal verification of embedded software, Proc, of 15th WSEAS Int Conf. on Computers, 2011, pp. 29-34.
Reiner Sailer, Enriquillo Valdez, Trent Jaeger, Roonald Perez, Leendert van Doorn, John Linwood Griffin, Stefan Berger., sHype: Secure Hypervisor Appraoch to Trusted Virtualized Systems (Feb. 2, 2005) (“Sailer”).
Rushby, John. Software verification and system assurance, Software Engineering and Formal Methods, 2009 Seventh IEEE International Conference, IEEE, 2009, pp. 3-10.
Santos, et al. “Trusted language runtime (TLR): enabling trusted applications on smartphones.” Proceedings of the 12th Workshop on Mobile Computing Systems and Applications. ACM, 2011, 6 pages.
Santos, Nano, et al. “Using ARM trustzone to build a trusted language runtime for mobile applications.” Proceedings of the 19th international conference on Architectural support for programming languages and operating systems. ACM, 2014, 14 pages.
Sewell, et al. “Translation validation for a verified OS kernel.” ACM SIGPLAN Notices 48.6, 2013, 11 pages.
Silicon Defense, “Worm Containment in the Internal Network”, (Mar. 2003), pp. 1-25.
Singh, S. , et al., “Automated Worm Fingerprinting”, Proceedings of the ACM/USENIX Symposium on Operating System Design and Implementation, San Francisco, California, (Dec. 2004).
Stephen, Marsh. “Formalising trust as a computational concept.” Ph.D. dissertation. University of Stirling; Scotland (1994), 184 pages.
Stumpf, et al. “An approach to a trustworthy system architecture using virtualization.” Autonomic and trusted computing. Springer Berlin Heidelberg, 2007, pp. 191-202.
Tews, Hendrik. “Micro hypervisor verification: Possible approaches and relevant properties.” NLUUG Voorjaarsconferentie, Apr. 2007, 14 pages.
Thomas H. Ptacek, and Timothy N. Newsham , “Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection”, Secure Networks, (“Ptacek”), (Jan. 1998).
U.S. Appl. No. 14/615,798, filed Feb. 6, 2015 Advisory Action dated Aug. 31, 2017.
U.S. Appl. No. 14/615,798, filed Feb. 6, 2015 Final Office Action dated May 25, 2017.
U.S. Appl. No. 14/615,798, filed Feb. 6, 2015 Non-Final Office Action dated Nov. 2, 2016.
U.S. Appl. No. 14/615,798, filed Feb. 6, 2015 Notice of Allowance dated Feb. 8, 2018.
Venezia, Paul , “NetDetector Captures Intrusions”, InfoWorld Issue 27, (“Venezia”), (Jul. 14, 2003).
Vladimir Getov: “Security as a Service in Smart Clouds—Opportunities and Concerns”, Computer Software and Applications Conference (COMPSAC), 2012 IEEE 36th Annual, IEEE, Jul. 16, 2012 (Jul. 16, 2012).
Wahid et al., Characterising the Evolution in Scanning Activity of Suspicious Hosts, Oct. 2009, Third International Conference on Network and System Security, pp. 344-350.
Whyte, et al., “DNS-Based Detection of Scanning Works in an Enterprise Network”, Proceedings of the 12th Annual Network and Distributed System Security Symposium, (Feb. 2005), 15 pages.
Wikipedia—“Haskell (programming language)” description, printed Oct. 4, 2013, 11 pages.
Wikipedia—“Hoare logic” description, printed Oct. 4, 2013, 7 pages.
Williamson, Matthew M., “Throttling Viruses: Restricting Propagation to Defeat Malicious Mobile Code”, ACSAC Conference, Las Vegas, NV, USA, (Dec. 2002), pp. 1-9.
Yuhei Kawakoya et al: “Memory behavior-based automatic malware unpacking in stealth debugging environment”, Malicious and Unwanted Software (Malware), 2010 5th International Conference on, IEEE, Piscataway, NJ, USA, Oct. 19, 2010, pp. 39-46, XP031833827, ISBN:978-1-4244-8-9353-1.
Zhang et al., The Effects of Threading, Infection Time, and Multiple-Attacker Collaboration on Malware Propagation, Sep. 2009, IEEE 28th International Symposium on Reliable Distributed Systems, pp. 73-82.

Provisional Applications (1)

	Number	Date	Country
	62019725	Jul 2014	US

Continuations (1)

	Number	Date	Country
Parent	14615798	Feb 2015	US
Child	16011495		US

Verification of trusted threat-aware visualization layer

Information

Patent Number

Date Filed

Date Issued

Inventors

Original Assignees

Examiners

Agents

CPC

Field of Search

CPC

International Classifications

Abstract